[fergusstrange]

The post-merge release build failed TestWindowsNativeFailuresReleaseHandles because the process-wide handle count rose from 113 to 119, while the token-security and PostgreSQL lifecycle assertions passed. A whole-process count cannot distinguish handles opened by the Go runtime from resources owned by the functions under test.

The test now records every token and job handle acquired by those native calls, verifies that the real CloseHandle succeeds exactly once for each resource, and requires no owned handles to remain after each error path or successful token-release callback. This replaces the previous allowance of two unexplained handles with exact resource assertions. The native close function joins the existing injectable syscall boundary; production still uses syscall.CloseHandle at the same cleanup points.

PowerShell CI repeats the cleanup test 50 times on each supported Go version, on both Windows x64 and ARM64, alongside the full existing suites and unchanged 90% coverage gate. Windows cross-compilation for both architectures and Windows vet passed locally; Public CI passed all 13 required checks, including both Windows architectures, both Go versions, all repeated handle assertions, and detached hidden Node launches. Combined production coverage is Production coverage: 90.98% (1564/1719 statements); required 90.00%.