This is actually an area I’m solving right now in the robotics space - you’ve got it exactly right. You need to restrict usage of calls to query the system time, deep control over the message passing later, and a custom scheduler for executing message handlers.

Edit: trading systems isn’t an area I considered for this work. A lot of parallels, though.