A reproducible panic can easily take down your whole fleet of servers, so you'd end up with a one process per request model without planning for this. Plus if

A reproducible panic can easily take down your whole fleet of servers, so you'd end up with a one process per request model without planning for this. Plus if a webserver handles more than one request in parallel (affects both multi-threaded and node.js style async designs), you want to finish handling all the other requests before shutting down gracefully. In my experience with C# even exceptions caused by bugs/failed assertions (which would map to panics in rust) almost never cause issues which require a server restart. It's a bit worse in Rust, since a GC collects memory more reliably in case of errors than Rust (but even in Rust leaks should rarely happen on panic)