verify(tree, times(1)).release(); // closed after exhaustion
    }

    @ParameterizedTest
    @ValueSource(strings = { "", "file.txt", "subdir" })
    @DisplayName("Name filter interaction: accept calls and rejections")
    void nameFilterAccepts(String acceptedName) throws Exception {
        // Arrange
        stubAcquireReturnsSelf();
        when(nameFilter.accept(any(), any())).thenReturn(false);

        @Override
        public String toString() {
            return String.format(
                    "CircuitBreakerMetrics[name=%s, state=%s, requests=%d, successes=%d, "
                            + "failures=%d, rejections=%d, successRate=%.2f%%, availability=%.2f%%]",
                    name, currentState, totalRequests, totalSuccesses, totalFailures, totalRejections, successRate, availability);
        }
    }

    /**

        loadBalancer.setStrategy(LoadBalancingStrategy.WEIGHTED_RANDOM);
        when(mockChannelManager.getHealthyChannels()).thenReturn(Arrays.asList(channel1, channel2));

        // Test multiple selections to ensure it works
        for (int i = 0; i < 10; i++) {
            ChannelInfo selected = loadBalancer.selectChannel(mockMessage);
            assertTrue(Arrays.asList(channel1, channel2).contains(selected));
        }

        when(treeHandle.send(any(), any(), (RequestParam[]) any())).thenAnswer(invocation -> {
            return invocation.getArgument(1);
        });

        // When: Create iterator with rejecting filter
        NetServerEnumIterator iterator = new NetServerEnumIterator(parent, treeHandle, "*", 0, nameFilter);

        // Then: Iterator should have no elements
        assertFalse(iterator.hasNext());

    int required = allRequired[requiredChosen];

    // ...do the first selection...
    selectInPlace(required, array, from, to);

    // ...then recursively perform the selections in the range below...
    int requiredBelow = requiredChosen - 1;
    while (requiredBelow >= requiredFrom && allRequired[requiredBelow] == required) {
      requiredBelow--; // skip duplicates of required in the range below

        // With filter, resource should be closed due to try-with-resources
        verify(filter).accept(resource);
        verify(resource).close();
    }

    @Test
    @DisplayName("Iterator with rejecting filter - finds next acceptable")
    void iteratorWithRejectingFilter() throws Exception {
        // Setup: first entry rejected, second accepted
        FileEntry entry1 = mock(FileEntry.class);

        normalizedPath = noUncValidator.validatePath("////server//share");
        assertEquals("\\server\\share", normalizedPath);

        // To properly test UNC rejection, we would need to fix the normalization logic
        // to preserve the leading double backslash for UNC paths
    }

    @Test
    public void testInvalidUncPath() throws Exception {

 * but given that any public suffix may become a host without warning, it is better to err on the
 * side of permissiveness and thus avoid spurious rejection of valid sites. Of course, to actually
 * determine addressability of any host, clients of this class will need to perform their own DNS
 * lookups.
 *
 * <p>During construction, names are normalized in two ways:
 *

    return (ImmutableSet<E>) RegularImmutableSet.EMPTY;
  }

  /**
   * Returns an immutable set containing the given element. Preferred over {@link
   * Collections#singleton} for code consistency, {@code null} rejection, and because the return
   * type conveys the immutability guarantee.
   */
  public static <E> ImmutableSet<E> of(E e1) {
    return new SingletonImmutableSet<>(e1);
  }

  /*

	}
	if len(ldapPolicies) == 0 && newGlobalAuthZPluginFn() == nil {
		writeSTSErrorResponse(ctx, w, ErrSTSInvalidParameterValue,
			fmt.Errorf("expecting a policy to be set for user `%s` or one of their groups: `%s` - rejecting this request",
				ldapActualUserDN, strings.Join(groupDistNames, "`,`")))
		return
	}

	expiryDur, err := globalIAMSys.LDAPConfig.GetExpiryDuration(r.Form.Get(stsDurationSeconds))
	if err != nil {