Lowering: AOT ≡ JIT

JouleOS ships one intent IR and lowers it two ways:

• AOT — an interpreter compiled into every binary. Always present, on every coordinate, including the no_std bare-metal kernel.
• JIT — a Cranelift-compiled tier, gated behind the jit feature, present only on hosted and bare-metal surfaces where it is allowed.

Why both

The AOT interpreter guarantees the program always runs, even where a JIT cannot exist — the kernel TCB is no_std, and Cranelift literally cannot link into it (which is also the capability proof). The JIT exists to make hot paths fast where the coordinate permits.

The equivalence guarantee

Two execution tiers are a correctness hazard: they can diverge. JouleOS closes that with a conformance assertion:

AOT ≡ JIT, bit-for-bit.

crates/joule-os-conformance/tests/lowering_aot_jit.rs runs the same programs through both tiers and asserts identical results. A divergence is a build failure, not a runtime surprise.

Specialized at boot

Beyond AOT/JIT, the IR is specialized against the control vector at boot — so the “same” program is lowered differently for native, browser, and bare-metal, while remaining observably equivalent. Portability without a lowest-common-denominator tax.