Problem

In __btree_pin_hs_dhandle, if __wt_session_release_dhandle fails after session_inuse has already been incremented, the error path never decrements it and never sets btree->hs_checkpoint_name. The key subtlety is that __wt_session_release_dhandle always clears session->dhandle via WT_DHANDLE_CLEAR regardless of success or failure, so the error path cannot use session->dhandle to recover the pointer. Since __wt_btree_close guards its release on btree->hs_checkpoint_name != NULL, the elevated session_inuse is never undone.