docs(playbook): test the shared premise when all hypotheses die; eliminate at the right granularity

Two deadlocked investigations both inherited 'file exists => sink constructed =>
no events flowed'; the pinned sink version creates no file until the first emitted
event, so the artifact proved the opposite. And 'a second log wrote in the same
directory' rules out directory-level failure, not per-handle failure — a proof
about the container is not a proof about the member.

admin_ui_cleanup.md

@@ -387,6 +387,23 @@ plus stating the claim's scope honestly ("verified in these three; not checked i
 when it hasn't. All three were caught by someone re-examining their own earlier assertion, never by
 the assertion being challenged.
 
+**When every hypothesis is falsified, test the SHARED PREMISE before adding a new one.** Two
+investigations into a 0-byte log file eliminated, between them, config levels, env vars in five
+scopes, ACLs, stale files and a two-stage bootstrap — and deadlocked. The unexamined premise both
+sides had inherited was *"the file exists, therefore the sink was constructed, therefore no events
+flowed."* A ten-minute local experiment against the pinned sink version showed it creates **no file
+at construction and no file when events are filtered** — the file appears only on the first emitted
+event. So the file's existence proved the opposite of what both investigations assumed, and every
+hypothesis either side had ranked was answering the wrong question. Nobody had checked which
+behaviours actually produce the observed artifact.
+
+**Eliminate at the right granularity.** The same investigation "killed" the write-failure hypothesis
+by observing a *second* log file writing bytes in the *same directory* — which proves the DIRECTORY
+is writable, not that THIS file HANDLE is. Separate sinks hold separate handles and fail separately.
+A proof about the container is not a proof about the member, and that substitution is invisible
+because the evidence is real and the reasoning feels airtight. Ask explicitly: *does my evidence
+range over exactly the thing I am ruling out, or over something that contains it?*
+
 **A correction is not automatically safer than the claim it replaces.** The first item above was
 corrected to "HistorianGateway has no block, so the bump restyles it" — which was *also* wrong, for a
 new reason: it had no Bootstrap button call sites either, so the kit's rule matches nothing. The