diff --git a/docs/work-items/ORCH-100/15-staging-log.md b/docs/work-items/ORCH-100/15-staging-log.md
new file mode 100644
index 0000000..17c2bbc
--- /dev/null
+++ b/docs/work-items/ORCH-100/15-staging-log.md
@@ -0,0 +1,36 @@
+---
+staging_status: SUCCESS
+work_item: ORCH-100
+stage: deploy-staging
+author_agent: deployer
+status: success
+created_at: 2026-06-10
+model_used: claude-opus-4-8
+timestamp: 2026-06-10T06:33:59Z
+base_url: http://localhost:8501
+---
+
+# Staging Gate Log
+
+Staging test suite completed against the live `orchestrator-staging` stand (8501). Canonical
+run **inside** the container (process-env `.env.staging`, so B6 registry-isolation is authoritative).
+Exit code **0** → advance.
+
+All REAL pipeline checks passed; the two sandbox-infra checks (C9a/C9b) failed and were waived
+per ORCH-061 (SANDBOX bot accounts are not members of the sandbox Plane project — not a pipeline
+regression). Trusting the exit code; not re-judging waived checks.
+
+INFRA-WAIVED: C9a Branch appears in orchestrator-sandbox, C9b Analyst job enqueued in staging queue (known sandbox-infra; real checks green)
+VERDICT: SUCCESS (exit 0) — SUCCESS (infra-waived): ['C9a Branch appears in orchestrator-sandbox', 'C9b Analyst job enqueued in staging queue'] are known sandbox-infra checks; all real checks green
+
+## Results (8/10 PASS; 2 SANDBOX_INFRA waived)
+- **Block A (SMOKE)**: A1 `/health` 200 ok · A2 `/queue` 200 (counts/max_concurrency/resilience) · A3 `ORCH_STAGING=true`. All PASS.
+- **Block B (ACCESS)**: B4 Plane sandbox accessible (sandbox=YES) · B5 Gitea orchestrator-sandbox push=true · B6 registry isolation (sandbox=YES, prod-ET=NO, prod-ORCH=NO). All PASS.
+- **Block C (E2E, mode=stub)**: C7 create issue in Plane SANDBOX PASS · C8 trigger pipeline `/webhook/plane` PASS · C9a branch-in-sandbox FAIL (waived) · C9b analyst-job-enqueued FAIL (waived). CLEANUP: Plane issue deleted (HTTP 204); no branch to delete.
+
+REAL failed: none.
+
+> Note: docker CLI is not installed on the host PATH; the canonical container run was performed via
+> the Docker Engine API over `/var/run/docker.sock` (exec inside `orchestrator-staging`), which is
+> functionally identical to `docker exec` — the script still ran with the container's `.env.staging`
+> process-env, keeping B6 authoritative.