App crashes on restart: ggml Metal residency set assertion failure

[malibio]

Problem

When the app restarts via app.restart() (e.g., after changing database location in Settings), the process crashes with a SIGABRT due to an assertion failure in the ggml Metal backend:

ggml_metal_device.m:608: GGML_ASSERT([rsets->data count] == 0) failed

The crash occurs because app.restart() calls std::process::exit(), which triggers C++ destructors via __cxa_finalize_ranges. The Metal residency set for the embedding model still has active data when ggml_metal_rsets_free runs, causing the assertion to fail.

Stack Trace (Key Frames)

tauri::process::restart
  → std::process::exit
    → __cxa_finalize_ranges
      → ggml_metal_device_free
        → ggml_metal_rsets_free
          → GGML_ASSERT([rsets->data count] == 0) failed
            → abort()

Root Cause

The NLP embedding engine (EmbeddingService wrapping llama.cpp) is never explicitly shut down before exit(). The Metal GPU resources (residency sets, buffers) are still active when the process destructor chain runs, triggering the assertion.

This is the same underlying issue as #885 (crash on quit), but manifests specifically through the restart_app command path introduced in #892.

Reproduction

1. Launch app: bun run dev:tauri
2. Open Settings (Cmd+,)
3. Click "Change Location" under Database
4. Select a folder
5. Confirm restart → crash with assertion failure

The app does restart successfully (the new process launches), but the old process crashes instead of exiting cleanly.

Related

• Issue Fix: SIGABRT crash on app exit in production builds #885 — Same ggml assertion crash on normal app quit
• PR App Configuration Architecture & Database Management UI #892 — Introduced restart_app command that triggers this path
• Issue Introduce AppServices container for hot-swappable database connections #894 — AppServices container refactor (comprehensive fix for graceful shutdown)

Proposed Fix

Before calling app.restart(), explicitly drop/shutdown the embedding resources:

1. Immediate fix: In restart_app, signal the EmbeddingProcessor to stop, drop the EmbeddingService/NLP engine (releases Metal resources), then call app.restart()
2. Comprehensive fix: Part of Introduce AppServices container for hot-swappable database connections #894 (AppServices container with tiered shutdown)

Environment

• macOS 26.3 (Darwin 25.3.0), Apple M4 Pro
• llama-cpp-sys-2 v0.1.132
• Tauri 2.8.5

Acceptance Criteria

• restart_app command gracefully shuts down embedding engine before restarting
• No SIGABRT / assertion failure on restart
• No crash report generated on restart
• Normal quit (Fix: SIGABRT crash on app exit in production builds #885) also addressed if feasible in same fix

[malibio]

Baseline: Frontend 3586 passed, Rust 788 passed. Starting implementation.