diff --git a/docs/plans/evidence/2026-11-10-opcua2/late-slope-rehearsal-startup-failure.json b/docs/plans/evidence/2026-11-10-opcua2/late-slope-rehearsal-startup-failure.json
new file mode 100644
index 000000000..e27604b04
--- /dev/null
+++ b/docs/plans/evidence/2026-11-10-opcua2/late-slope-rehearsal-startup-failure.json
@@ -0,0 +1,80 @@
+{
+  "scope": "Failed separate 60-second rehearsal startup; no descriptor/canonical test executed.",
+  "acceptance": false,
+  "rawDirectory": "/private/tmp/opcua2-late-slope-rehearsal2-626cb4f7",
+  "rehearsal": {
+    "scope": "60-second canonical diagnostic rehearsal only",
+    "acceptance": false,
+    "sourceRevision": "626cb4f7f1cae85e606223439c021575ca371e78",
+    "bundleReceiptSha256": "7f7917dee078ef99a45c068f2cfc4166a6f80e6f3e132bd75058d509e12d1db3",
+    "originalScriptSha256": "2a6ecc8ca757980586efea69f35ef305eb903a04941577d83c7cbd6ed797df33",
+    "rehearsalScriptSha256": "5e9c99652dc9bf5210df81c1e0557909063abb121fd2abc6ff1ca37942ab6a47",
+    "wrapperSha256": "eb974a6d9d879798a2368478da9d66d8cf6b7fe332877351a11017b81d6fe52c",
+    "durationSeconds": 60,
+    "outerDeadlineSeconds": 240,
+    "runId": "22ca83d5c7ed4241965be528c349730d",
+    "command": [
+      "docker",
+      "--host",
+      "unix:///<local-home>/.orbstack/run/docker.sock",
+      "run",
+      "--rm",
+      "--init",
+      "--pull",
+      "never",
+      "--network",
+      "none",
+      "--platform",
+      "linux/arm64",
+      "--read-only",
+      "--workdir",
+      "/task",
+      "--name",
+      "opcua-late-slope-22ca83d5c7ed4241965be528c349730d",
+      "--label",
+      "org.otopcua.late-slope-run=22ca83d5c7ed4241965be528c349730d",
+      "-e",
+      "OTOPCUA_SOAK_BUILD_SHA=626cb4f7f1cae85e606223439c021575ca371e78",
+      "-v",
+      "/private/tmp/opcua2-late-slope-reviewed-626cb4f7/app:/app:ro",
+      "-v",
+      "/private/tmp/opcua2-late-slope-reviewed-626cb4f7/tools:/tools:ro",
+      "-v",
+      "/private/tmp/opcua2-late-slope-rehearsal2-626cb4f7:/task",
+      "-v",
+      "/private/tmp/opcua2-late-slope-rehearsal2-626cb4f7/rehearsal.sh:/rehearsal.sh:ro",
+      "sha256:b04611ee9e1b7d36797012ed921962c57189cb4dbb3dff12afb8e158110f293b",
+      "bash",
+      "/rehearsal.sh"
+    ],
+    "wallSeconds": 1.3811107500223443,
+    "containerExitStatus": 1,
+    "containerRemoved": true,
+    "diagnosticCompleted": false,
+    "workloadLaunched": true,
+    "lateSlopeWorkloadLaunched": false,
+    "executionErrors": [],
+    "validationError": "Rehearsal process failed",
+    "rawHashes": {
+      "container.log": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "descriptor-controls.log": "c6e135b923a2f0e2fb972b36c836c727fb2433136323f081b5fe21edd7d56349"
+    }
+  },
+  "rawHashes": {
+    "plan.json": "330070e74b4c301b044f0c063fbb736c6cb146b53d751fbed4780f922c59a170",
+    "rehearsal.sh": "5e9c99652dc9bf5210df81c1e0557909063abb121fd2abc6ff1ca37942ab6a47",
+    "rehearsal-receipt.json": "b4324c809cbf7272ffd696133917e723afbeb627d28a5a052ce03f462f91756c",
+    "container.log": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    "controller-runtime.txt": "a642f96420f847eaaaccec852e41cc349d430a7d823242e08cb0f3498331056e",
+    "descriptor-controls.log": "c6e135b923a2f0e2fb972b36c836c727fb2433136323f081b5fe21edd7d56349",
+    "container-exit-status.txt": "4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865"
+  },
+  "rawWrapperSha256": "eb974a6d9d879798a2368478da9d66d8cf6b7fe332877351a11017b81d6fe52c",
+  "canonicalWorkloadStarted": false,
+  "descriptorTrxPresent": false,
+  "runtimeProofPresent": false,
+  "cause": "NuGet-Migrations named mutex uses /tmp/.dotnet/shm/session1 despite TMPDIR; mkdir returned EROFS with the read-only root filesystem.",
+  "correction": "Keep read-only root and expose the same fresh private output/tmp as /tmp. Review actual tool changes and a new immutable bundle/plan before another execution.",
+  "review": "Astra verified original failure/cleanup and approved private alias design only. No long launch or release approval.",
+  "receiptNote": "The wrapper workloadLaunched flag records container invocation; the absence of all test evidence and the CLI startup error prove no canonical or descriptor body started."
+}