diff --git a/src/commands/doctor/shared/channel-legacy-config-migrate.test.ts b/src/commands/doctor/shared/channel-legacy-config-migrate.test.ts
index 54d1c62e0bf..aba988ba9f9 100644
--- a/src/commands/doctor/shared/channel-legacy-config-migrate.test.ts
+++ b/src/commands/doctor/shared/channel-legacy-config-migrate.test.ts
@@ -1,8 +1,38 @@
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";
 import { applyChannelDoctorCompatibilityMigrations } from "./channel-legacy-config-migrate.js";
 
+const applyPluginDoctorCompatibilityMigrations = vi.hoisted(() => vi.fn());
+
+vi.mock("../../../plugins/doctor-contract-registry.js", () => ({
+  applyPluginDoctorCompatibilityMigrations: (...args: unknown[]) =>
+    applyPluginDoctorCompatibilityMigrations(...args),
+}));
+
 describe("bundled channel legacy config migrations", () => {
   it("normalizes legacy private-network aliases exposed through bundled contract surfaces", () => {
+    applyPluginDoctorCompatibilityMigrations.mockReturnValueOnce({
+      config: {
+        channels: {
+          mattermost: {
+            network: {
+              dangerouslyAllowPrivateNetwork: true,
+            },
+            accounts: {
+              work: {
+                network: {
+                  dangerouslyAllowPrivateNetwork: false,
+                },
+              },
+            },
+          },
+        },
+      },
+      changes: [
+        "Moved channels.mattermost.allowPrivateNetwork → channels.mattermost.network.dangerouslyAllowPrivateNetwork (true).",
+        "Moved channels.mattermost.accounts.work.allowPrivateNetwork → channels.mattermost.accounts.work.network.dangerouslyAllowPrivateNetwork (false).",
+      ],
+    });
+
     const result = applyChannelDoctorCompatibilityMigrations({
       channels: {
         mattermost: {
@@ -16,6 +46,10 @@ describe("bundled channel legacy config migrations", () => {
       },
     });
 
+    expect(applyPluginDoctorCompatibilityMigrations).toHaveBeenCalledWith(expect.any(Object), {
+      pluginIds: ["mattermost"],
+    });
+
     const nextChannels = (result.next.channels ?? {}) as {
       mattermost?: Record<string, unknown>;
     };
diff --git a/src/commands/doctor/shared/empty-allowlist-policy.test.ts b/src/commands/doctor/shared/empty-allowlist-policy.test.ts
index 689bc7bc127..a1cee9df927 100644
--- a/src/commands/doctor/shared/empty-allowlist-policy.test.ts
+++ b/src/commands/doctor/shared/empty-allowlist-policy.test.ts
@@ -1,6 +1,23 @@
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";
 import { collectEmptyAllowlistPolicyWarningsForAccount } from "./empty-allowlist-policy.js";
 
+vi.mock("../channel-capabilities.js", () => ({
+  getDoctorChannelCapabilities: (channelName?: string) => ({
+    dmAllowFromMode: "topOnly",
+    groupModel: channelName === "discord" ? "route" : "sender",
+    groupAllowFromFallbackToAllowFrom: channelName !== "imessage",
+    warnOnEmptyGroupSenderAllowlist: channelName !== "discord",
+  }),
+}));
+
+vi.mock("./channel-doctor.js", () => ({
+  shouldSkipChannelDoctorDefaultEmptyGroupAllowlistWarning: ({
+    channelName,
+  }: {
+    channelName?: string;
+  }) => channelName === "zalouser",
+}));
+
 describe("doctor empty allowlist policy warnings", () => {
   it("warns when dm allowlist mode has no allowFrom entries", () => {
     const warnings = collectEmptyAllowlistPolicyWarningsForAccount({
diff --git a/src/commands/doctor/shared/empty-allowlist-scan.test.ts b/src/commands/doctor/shared/empty-allowlist-scan.test.ts
index 6c17c8c10bd..88d60a8e002 100644
--- a/src/commands/doctor/shared/empty-allowlist-scan.test.ts
+++ b/src/commands/doctor/shared/empty-allowlist-scan.test.ts
@@ -1,6 +1,19 @@
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";
 import { scanEmptyAllowlistPolicyWarnings } from "./empty-allowlist-scan.js";
 
+vi.mock("../channel-capabilities.js", () => ({
+  getDoctorChannelCapabilities: (channelName?: string) => ({
+    dmAllowFromMode: "topOnly",
+    groupModel: "sender",
+    groupAllowFromFallbackToAllowFrom: channelName !== "imessage",
+    warnOnEmptyGroupSenderAllowlist: channelName !== "discord",
+  }),
+}));
+
+vi.mock("./channel-doctor.js", () => ({
+  shouldSkipChannelDoctorDefaultEmptyGroupAllowlistWarning: () => false,
+}));
+
 describe("doctor empty allowlist policy scan", () => {
   it("scans top-level and account-scoped channel warnings", () => {
     const warnings = scanEmptyAllowlistPolicyWarnings(