- getdata.test now checks the child job state before reading its outlib: a cancelled child returns no webout, so the previous call's members were being asserted against and the failures described the wrong problem. - validatefilter.test's inputdatasets call needs a _PROGRAM column, which mx_execute reads to decide what to run - without it the job stopped at 'The _PROGRAM column must exist'. - stagedata.test.3 covers the new RLS check: an MPE_ROW_LEVEL_SECURITY rule naming a derived variable must be rejected at save time.