This article mentions a few of the reasons why some of our best attempts at defining languages that are "trivially correct" keep failing.

Among other examples, it specifically mentions that you if lego together two Push-Down Automata chatting with each other you get a Turing Machine back out. It doesn't include my other favorite recent example that we found a 0-day sandbox escape in the Universal Turing Machine itself.

The problems generally keep coming back to the Church-Turing Hypothesis that if you've got one Turing Complete language you've got theoretical access to them all.

Turing Completeness in turn seems an "emergent property" rather than a hard bar to clear. Rule 110 [0] shows Turing Completeness in the mathematical equivalent of a petri dish. We've built Turing Machines out of Magic the Gathering card game decks [1].

To some extent if there was a way to build a truly, well enforced, secure scripting language you would think that we would have already found it given how important it would be to security and to safety.

[0] https://en.wikipedia.org/wiki/Rule_110

[1] https://www.toothycat.net/~hologram/Turing/index.html

But again, I don't need the full Turing complete machine. I can just say something like no function can have more than 1000 calls in a fun, and similar for loops - that's suddenly going to take away a lot of your Turing machine.

I'm not sure where the limits we need to place are, but that's the reasonable place to start.