@newt @mjg59 @a1ba OpenGenera had no issue supporting guest languages (https://en.wikipedia.org/wiki/Genera_(operating_system)#Programming_languages), so you're not technically stuck with a single language.
You can make a lot of guarantees insofar as hardware side-channels aren't involved.
Especially when you don't rely on static guarantees and permit for dynamic checking (a whole lot of the theoretical problems for static solutions can be handled this way, although in many cases imperfect heuristics are still required).