And could run it under an angel, auto rebooting when mem leak above a certain threshold and traffic below a certain level, allowing a couple days' window to look for a low impact time.

This is more or less what Apache and IIS do with child processes or long running threads. It's a production proven approach.