+ "The correctness of CycleDetectingReentrantReadWriteLock depends on "
            + "the fact that the shadowed ReadLock and WriteLock are never used or "
            + "exposed by the superclass implementation. If the implementation has "
            + "changed, the code must be re-inspected to ensure that the "
            + "assumption is still valid.",
        24,

            + "The correctness of CycleDetectingReentrantReadWriteLock depends on "
            + "the fact that the shadowed ReadLock and WriteLock are never used or "
            + "exposed by the superclass implementation. If the implementation has "
            + "changed, the code must be re-inspected to ensure that the "
            + "assumption is still valid.",
        24,

        void dispose_nullContext_noop() throws Exception {
            setPrivateField(ctx, "gssContext", null);
            assertDoesNotThrow(() -> ctx.dispose());
        }
    }

    // Helper to build a minimal exported name token understood by MIEName(byte[])
    // Format: TOK_ID(2 bytes) | OID_LEN(2 bytes) | OID_DER | NAME_LEN(4 bytes) | NAME(bytes)
    private static byte[] buildExportName(Oid mech, String name) throws GSSException {

    }

    // GET /api/admin/elevateword/download
    /**
     * Downloads all elevate words as a CSV file.
     * Creates a temporary file with the exported data for download.
     *
     * @param body download parameters
     * @return stream response containing the CSV file
     */
    @Execute
    public StreamResponse get$download(final DownloadBody body) {

        assertEquals("DOMAIN", result.getUserDomain());
        assertEquals("user", result.getUsername());
        // Cannot verify challenge and responses as they are not exposed in the API

        // Verify that the response is not modified for a successful authentication
        verify(mockResponse, never()).setHeader(anyString(), anyString());

    public static final int ACB_WSTRUST = 128;
    /** Account control bit flag: Server trust account */
    public static final int ACB_SVRTRUST = 256;
    /** Account control bit flag: Password does not expire */
    public static final int ACB_PWNOEXP = 512;
    /** Account control bit flag: Account is auto-locked */
    public static final int ACB_AUTOLOCK = 1024;

    public static final int ACB_WSTRUST = 128;
    /** Account control bit flag: Server trust account */
    public static final int ACB_SVRTRUST = 256;
    /** Account control bit flag: Password does not expire */
    public static final int ACB_PWNOEXP = 512;
    /** Account control bit flag: Account is auto-locked */
    public static final int ACB_AUTOLOCK = 1024;

 * entries may be counted by {@link Map#size}, but will never be visible to read or write
 * operations. A partially-reclaimed entry is never exposed to the user. Any {@link Map.Entry}
 * instance retrieved from the map's {@linkplain Map#entrySet entry set} is a snapshot of that
 * entry's state at the time of retrieval; such entries do, however, support {@link

        response.header("Pragma", "no-cache");
        response.header("Cache-Control", "no-cache");
        response.header("Expires", "Thu, 01 Dec 1994 16:00:00 GMT");
        response.contentTypeOctetStream();
        return response.stream(out -> {
            try {
                downloadObject(getObjectName(pi.getPath(), pi.getName()), out);

                            if (!downloaded) {
                                // prevent additional checks of this artifact until it expires again
                                destination.setLastModified(System.currentTimeMillis());
                            }
                        } catch (UnsupportedOperationException e) {