diff --git a/REFACTORING-AUDIT.md b/REFACTORING-AUDIT.md
index 2e5a62b..69a9e05 100644
--- a/REFACTORING-AUDIT.md
+++ b/REFACTORING-AUDIT.md
@@ -447,6 +447,7 @@ Migration order implied by the map: isolate shared infrastructure constructors (
 - Alert level and source presentation labels now use `application/alert.LevelLabel` and `SourceLabel`; asynchronous email/SMS delivery, five-retry behavior, and error propagation remain at the alert adapter. Focused Wallet tests pass in `085cb25`.
 - Alert subject formatting now uses `application/alert.Subject`, preserving timestamp and localized level/source labels while delivery remains adapter-owned. Focused Wallet tests pass in `be29c11`.
 - Alert `Emit` now rejects nil events synchronously instead of panicking in its delivery goroutine; valid event delivery behavior is unchanged. Focused alert tests pass in `4fc4726`.
+- Alert `Emit` now also rejects events without IAM/user data before starting the delivery goroutine, preventing nil dereferences. Focused alert tests pass in `b3e1dbc`.
 
 ### `W010` — cron/stream bootstrap checkpoint
 
diff --git a/REFACTORING-TODO.md b/REFACTORING-TODO.md
index 461488a..f11212d 100644
--- a/REFACTORING-TODO.md
+++ b/REFACTORING-TODO.md
@@ -327,5 +327,5 @@ Append one row whenever a task changes status. Existing rows are never rewritten
 | 2026-08-30 | W013 | `STARTED` | `DONE` | Removed federation persistence/model code, wallet and transaction federation fields, federation protobuf messages, stale API route/docs, and remaining runtime references; regenerated Wallet contracts for Wallet/Auth/API; Wallet, Auth, and API tests pass. Wallet `a38501d`/`7ae90cc`, Auth `446e875`, API `c450264`/`c2c076c`. |
 | 2026-08-30 | W006 | `TODO` | `STARTED` | Added `application/withdrawal`, `application/deposit`, `application/transfer`, and `application/transaction`; routed IRT reconciliation, IPG conversion/settlement/payer identity, transfer validation, transaction construction/completion, balance-change display policy, deterministic wallet-lock ordering, insufficient-balance failure policy, Stellar status updates, and transaction-event support through application boundaries; focused Wallet tests pass in `a43a758`. Business failure/refund orchestration remains. |
 | 2026-08-30 | W007 | `TODO` | `STARTED` | Added typed `application/market` policies for agreement tolerance, available amount, raw conversion, positive order inputs, ICO publisher validation, order status codes, and market pricing calculation; market ICO/order validation and calculation delegate through compatibility mapping. Synchronous settlement/stream locking fixed in `3004bb9`; order lifecycle, settlement, contract generation, and adapter extraction remain. |
-| 2026-08-30 | W008 | `TODO` | `STARTED` | Added `application/alert` level/source label and subject policies plus nil-event validation; alert delivery keeps existing asynchronous email/SMS retry behavior. Focused Wallet tests pass in `4fc4726`. Delivery, retry, persistence, and adapter extraction remain. |
+| 2026-08-30 | W008 | `TODO` | `STARTED` | Added `application/alert` level/source label and subject policies plus nil/incomplete-event validation; alert delivery keeps existing asynchronous email/SMS retry behavior. Focused Wallet tests pass in `b3e1dbc`. Delivery, retry, persistence, and adapter extraction remain. |
 | 2026-08-30 | W010 | `TODO` | `STARTED` | Added `application/cron.Retry`, `application/stream.IsNew`, and stream external-deposit transaction policy; `SetupCronRepository` initializes only PostgreSQL for cron jobs. Focused Wallet tests pass in `61768e7`. Stream and remaining process composition work remain. |