diff --git a/experiments/build-firecracker-variants.sh b/experiments/build-firecracker-variants.sh
new file mode 100755
index 0000000..5946f12
--- /dev/null
+++ b/experiments/build-firecracker-variants.sh
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Build reproducible Firecracker kernel variants without changing the source
+# config. Run this on Linux with the builder dependencies installed.
+
+repo_dir="$(cd "$(dirname "$0")/.." && pwd)"
+version="${VERSION:-v6.1}"
+arch="${ARCH:-x86_64}"
+base_config="${BASE_CONFIG:?set BASE_CONFIG to the fetched deployed vmlinux.config}"
+work_root="${WORK_ROOT:-$repo_dir/.experiment-work}"
+dist_root="${DIST_ROOT:-$repo_dir/.experiment-dist}"
+
+if [[ ! -f "$base_config" ]]; then
+  echo "base config not found: $base_config" >&2
+  exit 1
+fi
+
+mkdir -p "$work_root" "$dist_root"
+variant_dir="$(mktemp -d "${TMPDIR:-/tmp}/zeish-kernel-config.XXXXXX")"
+variant_config="$variant_dir/firecracker-acpi.config"
+cleanup() {
+  rm -rf "$variant_dir"
+}
+trap cleanup EXIT
+
+cp "$base_config" "$variant_config"
+sed -i.bak \
+  -e 's/^CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y$/# CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES is not set/' \
+  "$variant_config"
+rm -f "$variant_config.bak"
+
+build_variant() {
+  local name="$1" config="$2"
+  ARCH="$arch" VERSION="$version" KERNEL_CONFIG_PATH="$config" \
+    USE_DOCKER=0 \
+    WORKDIR="$work_root/$name" \
+    DIST_DIR="$dist_root/$name" \
+    "$repo_dir/build.sh"
+}
+
+build_variant baseline "$base_config"
+build_variant acpi "$variant_config"
+
+echo "Artifacts and resolved configs are under $dist_root."
+echo "Record sha256sum, the source commit, and the compiler before publishing."
diff --git a/experiments/firecracker-kernel-report.md b/experiments/firecracker-kernel-report.md
new file mode 100644
index 0000000..bb6b804
--- /dev/null
+++ b/experiments/firecracker-kernel-report.md
@@ -0,0 +1,101 @@
+# Firecracker kernel experiment
+
+Status: experimental. Updated 2026-09-08. This report records builds and
+direct boot observations; it does not recommend changing the production
+kernel.
+
+## Reproduction
+
+The deployed control kernel was fetched read-only from `/images/kernel` on the
+benchmark worker. Its config SHA256 is
+`e9d4a0b613ba7c1393347f7d46d90b0bb60366ba895766bb123236efc11f7674`; its
+embedded version is `Linux 6.1.0-zeish+`, built with GCC 13.3 and binutils
+2.42. The build used Linux commit
+`830b3c68c1fb1e9176028d02ef86f3cf76aa2476` (`Linux 6.1`), matching the
+deployed kernel's reported version. The deployed source provenance was not
+verified.
+The container ran on an arm64 host with the x86_64 cross compiler:
+
+```text
+x86_64-linux-gnu-gcc 13.3.0
+GNU binutils 2.42
+```
+
+The config has `CONFIG_ACPI=y`, `CONFIG_PCI=y`, and
+`CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y`. The experiment script requires this
+fetched config through `BASE_CONFIG`, then creates a temporary ACPI candidate
+with only `CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=n`:
+
+```bash
+BASE_CONFIG=/path/to/vmlinux.config VERSION=v6.1 \
+  experiments/build-firecracker-variants.sh
+```
+
+The separately built ACPI candidate changes only:
+
+```text
+CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y -> not set
+```
+
+`CONFIG_ACPI=y`, `CONFIG_PCI=y`, and `CONFIG_X86_MPPARSE` disabled are retained
+in that candidate.
+
+## Artifacts
+
+All hashes are SHA256 of the uncompressed `vmlinux` ELF:
+
+| Variant | Artifact hash |
+| --- | --- |
+| rebuilt deployed-config v6.1 baseline | `5e5133ee54f310e86aa62fcd37a352598ca88bc3c8da189972e212e1aec24a3d` |
+| rebuilt deployed-config v6.1 ACPI candidate | `e5d4a0ce099a798d1adf54e763e7a2edda4d498438028f82c7cbde74420d0c81` |
+| v6.12.8 migrated CI config | `18b05504039b5838d9b5467ff2081c239935760647ef43b6fd0966321adebc22` |
+| v6.12.8 no optional features | `92b680f96105c006b1bae5dcc2b7c9d64f138447a122598111dfc3f8ca8a8ae1` |
+| v6.12.8 ACPI candidate | `ca95740a9c0cf13401b5a36ca90445de0fcfaa4489b67b90d8ec8be03d9a6122` |
+
+The v6.12 builds used a non-deployed CI config and are retained only as
+exploratory controls. They must not be compared with the deployed kernel as a
+production upgrade candidate.
+
+The v6.1 rebuild consumed the exact deployed config as input, but its resolved
+`.config` is not byte-identical: cross-build capability checks left
+`CONFIG_CC_CAN_LINK` and `CONFIG_CC_CAN_LINK_STATIC` unset, which consequently
+dropped `CONFIG_BPFILTER_UMH`. The reason those capability checks differed was
+not verified. The rebuilt hashes below therefore identify controlled build
+artifacts, not an exact reproduction of the deployed binary.
+
+## Direct boot observation
+
+Using the direct boot-to-listener harness, ten interleaved runs measured:
+
+| Kernel | Median | Range | Median serial bytes |
+| --- | ---: | ---: | ---: |
+| deployed Linux 6.1 | 1132 ms | 1122-1157 ms | 5364 |
+| Linux 6.12 base | 1245.5 ms | 1226-1376 ms | 5317 |
+| Linux 6.12 ACPI | 1221.5 ms | 1197-1763 ms | 4907 |
+| Linux 6.12 without optional subsystems | 1248.5 ms | 1223-1259 ms | 5334 |
+
+The v6.12 ACPI candidate reduced serial output but did not improve readiness
+and had a large outlier. These measurements use temporary Firecracker VMs
+without machined's production network namespace, MMDS, or authentication.
+
+The v6.1 ACPI rebuild was performed incrementally from the baseline source.
+The following command path was executed in the isolated Docker build
+container; the wrapper script is the repeatable two-worktree form for hosts
+with the cross compiler installed:
+
+```bash
+cd /workspace/.work/current/linux-firecracker
+./scripts/config --disable VIRTIO_MMIO_CMDLINE_DEVICES
+make ARCH=x86 CROSS_COMPILE=x86_64-linux-gnu- olddefconfig
+make -j8 ARCH=x86 CROSS_COMPILE=x86_64-linux-gnu- vmlinux
+```
+
+The final interleaved v6.1 direct harness run measured the deployed binary at
+1160.5 ms median (1137-1181 ms) and the rebuilt baseline at 1146.5 ms
+(1127-1164 ms). A separate paired run measured the rebuilt baseline at
+1155.5 ms (1142-1340 ms) and the ACPI candidate at 1138.5 ms (1119-1161 ms),
+about 17 ms or 1.5 percent lower for the listener marker. All runs booted
+successfully. This is a bounded listener-only result, not proof of an
+improvement at the authenticated production readiness boundary; see the
+companion measurements in `zeishdev/compute#141`. No default rollout or
+snapshot compatibility claim follows from it.