docs: reconcile batch and webhook integration

.project-docs/50-evidence/evidence-index.md

@@ -26,6 +26,8 @@ Use this index for searchable, traceable evidence records.
 | 2026-09-07 | Exact ERP account identity and extension `0.5.169` | Repository, focused identity, package/source, and release hashes verified; not loaded or deployed | [Integration task](../30-worklog/tasks/20260907-integrate-all-changes-9d2e7c41.md) | One unique `#Lable_UserName` node plus normalized full equality is now the only accepted identity proof; missing, duplicate, blank, substring-only, and unrelated page-text matches fail closed without exposing the observed account. Uncertain writes direct manual read-only verification to the immutable task owner. |
 | 2026-09-07 | Required-field-only passenger roster normalization `v1.4.0` | Synthetic/parser, Skill-package, release, and 12-page DOCX rendering verified; exact uploaded file unavailable for replay | [Integration task](../30-worklog/tasks/20260907-integrate-all-changes-9d2e7c41.md) | The 12 required source semantics alone drive extraction and validation; ordinary non-import columns are ignored and excluded from canonical TSV, while workbook-wide active-content checks remain. |
 | 2026-09-07 | Assignee-based leader dashboard and administrator task-plane isolation | Repository and disposable-PostgreSQL verified; runtime rollout not performed | [Integration task](../30-worklog/tasks/20260907-integrate-all-changes-9d2e7c41.md) | Team leads see assigned manual and AgentBus work through the bounded read model; migration 021 removes and rejects administrator task principals, while UI/HTTP/service guards deny administrator task access. |
+| 2026-09-08 | Program-only shared-child batch creation and extension `0.5.170` | Repository, parser/browser regression, release package, and hash verified; no live ERP write | [Feature task](../30-worklog/tasks/20260908-shared-child-batch-create-4e7c2a91.md) | Migration 022 admits the nineteenth route without granting it; all matching parents are enumerated before writes, ordered by date/tid, and executed with per-parent receipts plus first-non-success stop/no-retry semantics. |
+| 2026-09-08 | Organization-level leader-summary external Webhook | Repository, fake-sender, and disposable-PostgreSQL verified; not deployed or externally sent | [Feature task](../30-worklog/tasks/20260908-leader-webhook-api-7c4e9a12.md) | Migration 023 retires unsent legacy AgentBus summaries and adds encrypted revisioned Webhook state/outbox; exact request shape, configuration isolation, privacy allowlist, terminal one-attempt outcomes, and strict accepted terminology passed regression. |
 
 ## When To Add Evidence