[throwaway729]

I did say it's a hard tech problem... :)

(But seriously, at least in theory, there are sort of obvious things you can do to isolate anything failure-critical behind statically or dynamically checked contracts, which then allows rapid iteration outside of the small set of things that are truly failure-critical. But you need those contracts trustworthy enough that you can iterate without worry, flexible enough that you can iterate on economically important sub-components, and applicable to a system or set of systems where this iteration gives you the trump card in a billion dollar(s) industry. As I said, it's "hard tech" -- which almost by definition means some people will think it's impossible.)