assertNull(copy.getSubject(), "Clone should still return null after refresh");
        }
    }

    @Test
    @DisplayName("renew: invokes getSubject and returns self")
    void testRenewInvokesGetSubjectAndReturnsSelf() {
        JAASAuthenticator auth = spy(new JAASAuthenticator());
        // Avoid real JAAS by stubbing getSubject
        doReturn(new Subject()).when(auth).getSubject();

        // Act