assertFalse(s2.isEmpty());
            assertTrue(s2.isBlank());
        }

        @ParameterizedTest(name = "type {0} -> {1}")
        @CsvSource({ "0, 0", "1, User", "2, Domain group", "3, Domain", "4, Local group", "5, Builtin group", "6, Deleted", "7, Invalid",
                "8, Unknown" })
        @DisplayName("getType and getTypeText cover all types")

 *   <dt>An IPv6 "IPv4 compatible" (or "compat") address, {@code "::192.168.0.1"}.
 *   <dd>{@code 00 00 00 00 00 00 00 00 00 00 00 00 c0 a8 00 01}
 *   <dt>An IPv6 "IPv4 mapped" address, {@code "::ffff:192.168.0.1"}.
 *   <dd>{@code 00 00 00 00 00 00 00 00 00 00 ff ff c0 a8 00 01}
 * </dl>
 *
 * <p>A few notes about IPv6 "IPv4 mapped" addresses and their observed use in Java.
 *

    assertThat(expected).hasMessageThat().isEqualTo("foo (2) must not be greater than size (1)");
  }

  public void testCheckPositionIndexes_ok() {
    checkPositionIndexes(0, 0, 0);
    checkPositionIndexes(0, 0, 1);
    checkPositionIndexes(0, 1, 1);
    checkPositionIndexes(1, 1, 1);
  }

  public void testCheckPositionIndexes_badSize() {
    assertThrows(IllegalArgumentException.class, () -> checkPositionIndexes(1, 1, -1));

    assertThat(expected).hasMessageThat().isEqualTo("foo (2) must not be greater than size (1)");
  }

  public void testCheckPositionIndexes_ok() {
    checkPositionIndexes(0, 0, 0);
    checkPositionIndexes(0, 0, 1);
    checkPositionIndexes(0, 1, 1);
    checkPositionIndexes(1, 1, 1);
  }

  public void testCheckPositionIndexes_badSize() {
    assertThrows(IllegalArgumentException.class, () -> checkPositionIndexes(1, 1, -1));

  /**
   * Maximum allowed false positive probability of detecting a hash flooding attack given random
   * input.
   */
  @VisibleForTesting(
      )
  static final double HASH_FLOODING_FPP = 0.001;

  /**
   * Maximum allowed length of a hash table bucket before falling back to a j.u.LinkedHashMap-based
   * implementation. Experimentally determined.
   */
  private static final int MAX_HASH_BUCKET_LENGTH = 9;

    assertThat(verifier.verify("127.0.0.2", session)).isFalse()
  }

  @Test fun wildcardsCannotMatchIpAddresses() {
    // openssl req -x509 -nodes -days 36500 -subj '/CN=*.0.0.1' -newkey rsa:512 -out cert.pem
    val session =
      session(
        """
        -----BEGIN CERTIFICATE-----
        MIIBkjCCATygAwIBAgIJAMdemqOwd/BEMA0GCSqGSIb3DQEBBQUAMBIxEDAOBgNV

    // Even-sized ranges should prefer the lower mean
    assertMean(2, 1, 4);
    assertMean(-3, -4, -1);
    assertMean(0, -1, 2);
    assertMean(0, Integer.MIN_VALUE + 2, Integer.MAX_VALUE);
    assertMean(0, 0, 1);
    assertMean(-1, -1, 0);
    assertMean(-1, Integer.MIN_VALUE, Integer.MAX_VALUE);

    // x == y == mean
    assertMean(1, 1, 1);
    assertMean(0, 0, 0);
    assertMean(-1, -1, -1);

  /**
   * Maximum allowed false positive probability of detecting a hash flooding attack given random
   * input.
   */
  @VisibleForTesting(
      )
  static final double HASH_FLOODING_FPP = 0.001;

  /**
   * Maximum allowed length of a hash table bucket before falling back to a j.u.LinkedHashMap-based
   * implementation. Experimentally determined.
   */
  private static final int MAX_HASH_BUCKET_LENGTH = 9;

        6,
        new boolean[] {true, true, false, true, false});
  }

  public void testRotateIndexed() {
    testRotate(new boolean[] {}, 0, 0, 0, new boolean[] {});

    testRotate(new boolean[] {true}, 0, 0, 1, new boolean[] {true});
    testRotate(new boolean[] {true}, 1, 0, 1, new boolean[] {true});
    testRotate(new boolean[] {true}, 1, 1, 1, new boolean[] {true});

    // Rotate the central 5 elements, leaving the ends as-is

    // Even-sized ranges should prefer the lower mean
    assertMean(2, 1, 4);
    assertMean(-3, -4, -1);
    assertMean(0, -1, 2);
    assertMean(0, Long.MIN_VALUE + 2, Long.MAX_VALUE);
    assertMean(0, 0, 1);
    assertMean(-1, -1, 0);
    assertMean(-1, Long.MIN_VALUE, Long.MAX_VALUE);

    // x == y == mean
    assertMean(1, 1, 1);
    assertMean(0, 0, 0);
    assertMean(-1, -1, -1);