diff --git a/docs/work-items/ORCH-123/15-staging-log.md b/docs/work-items/ORCH-123/15-staging-log.md
new file mode 100644
index 0000000..b050ffc
--- /dev/null
+++ b/docs/work-items/ORCH-123/15-staging-log.md
@@ -0,0 +1,35 @@
+---
+staging_status: SUCCESS
+work_item: ORCH-123
+stage: deploy-staging
+author_agent: deployer
+status: success
+created_at: 2026-06-16
+model_used: claude-opus-4-8
+timestamp: 2026-06-16T05:57:12Z
+base_url: http://localhost:8501
+---
+
+# Staging Gate Log
+
+Staging test suite completed against the live staging instance (`orchestrator-staging`, port 8501).
+
+**Execution strategy (ORCH-123):** the canonical `docker exec orchestrator-staging … staging_check.py
+--base-url http://localhost:8501 --mode stub` was initiated **host-side via ssh**
+(`slin@127.0.0.1`), because the prod container carries no docker CLI (`Dockerfile` ships only
+`openssh-client git curl`). The suite itself runs INSIDE `orchestrator-staging`.
+
+**Result:** `8/10 checks PASS`, exit code `0` → `staging_status: SUCCESS`.
+
+- REAL failed: none — every real check (Block A smoke, Block B access incl. B6 registry isolation
+  `sandbox=YES, prod-ET=NO, prod-ORCH=NO`, Block C create/trigger) is green.
+- Waived (ORCH-061 infra tolerance, `staging_infra_tolerance_enabled=True`):
+
+```
+INFRA-WAIVED: C9a Branch appears in orchestrator-sandbox, C9b Analyst job enqueued in staging queue (known sandbox-infra; real checks green)
+VERDICT: SUCCESS (exit 0) — SUCCESS (infra-waived): ['C9a Branch appears in orchestrator-sandbox', 'C9b Analyst job enqueued in staging queue'] are known sandbox-infra checks; all real checks green
+```
+
+C9a/C9b depend on SANDBOX bot accounts being project members (sandbox-infra, not the pipeline) and
+are tolerated when every REAL check is green. The exit-code → verdict mapping is unchanged: trust the
+exit code (0 → SUCCESS); waived checks are not re-judged.