verify(this.mechContext, never()).isSupported(any);
    }

    @Test
    @DisplayName("initSecContext with empty len returns initial NegTokenInit and delegates to mechContext")
    void testInitSecContextInitialToken() throws Exception {
        SpnegoContext ctx = newContext();

        // The initial token path should ask the mechanism for a zero-length optimistic token