docs(02-04): complete export services plan — CsvExportService and HtmlExportService

- SUMMARY.md created for plan 02-04
- STATE.md: progress updated to 87%, session recorded, decision added
- ROADMAP.md: phase 02 progress updated (5/7 plans complete)

.planning/STATE.md

@@ -3,14 +3,14 @@ gsd_state_version: 1.0
 milestone: v1.0
 milestone_name: milestone
 status: planning
-stopped_at: Completed 02-02-PLAN.md
+stopped_at: Completed 02-04-PLAN.md
-last_updated: "2026-04-02T11:56:31.288Z"
+last_updated: "2026-04-02T12:00:54.419Z"
 last_activity: 2026-04-02 — Roadmap created, requirements mapped, all 42 v1 requirements assigned to phases
 progress:
   total_phases: 5
   completed_phases: 1
   total_plans: 15
-  completed_plans: 12
+  completed_plans: 13
   percent: 13
 ---
 
@@ -63,6 +63,7 @@ Progress: [█░░░░░░░░░] 13%
 | Phase 02-permissions P03 | 1min | 1 tasks | 5 files |
 | Phase 02-permissions P01 | 5min | 2 tasks | 9 files |
 | Phase 02-permissions P02 | 7min | 2 tasks | 4 files |
+| Phase 02-permissions P04 | 1min | 2 tasks | 2 files |
 
 ## Accumulated Context
 
@@ -104,6 +105,7 @@ Recent decisions affecting current work:
 - [Phase 02-permissions]: Principal.Email removed from CSOM load expression — Email only exists on User subtype, not Principal base class
 - [Phase 02-permissions]: Folder is not a SecurableObject in CSOM — ListItem used for permission extraction — Required by CSOM type system; Folder inherits from ClientObject not SecurableObject
 - [Phase 02-permissions]: Principal.Email excluded from CSOM Include — email not needed for PermissionEntry — Principal base type has no Email property; only User subtype does; avoids CS1061
+- [Phase 02-permissions]: CsvExportService uses UTF-8 with BOM for Excel compatibility; HtmlExportService uses UTF-8 without BOM
 
 ### Pending Todos
 
@@ -117,6 +119,6 @@ None yet.
 
 ## Session Continuity
 
-Last session: 2026-04-02T11:56:31.286Z
+Last session: 2026-04-02T12:00:50.874Z
-Stopped at: Completed 02-02-PLAN.md
+Stopped at: Completed 02-04-PLAN.md
 Resume file: None

.planning/phases/02-permissions/02-04-SUMMARY.md

@@ -0,0 +1,113 @@
+---
+phase: 02-permissions
+plan: "04"
+subsystem: export
+tags: [csv, html, permissions, export, csom, rfc4180]
+
+# Dependency graph
+requires:
+  - phase: 02-permissions plan 02
+    provides: PermissionEntry record type and stub export service classes
+
+provides:
+  - CsvExportService: merges PermissionEntry rows by (Users, PermissionLevels, GrantedThrough) and writes RFC 4180 CSV with UTF-8 BOM
+  - HtmlExportService: generates self-contained interactive HTML report with inline CSS/JS, stats cards, badges, and user pills
+
+affects:
+  - 02-permissions (plans 05-07 may call these services)
+  - Phase 3+ (any feature using CSV or HTML permission exports)
+
+# Tech tracking
+tech-stack:
+  added: []
+  patterns:
+    - "GroupBy merge pattern: group PermissionEntry by composite key then pipe-join distinct URLs/Titles"
+    - "Self-contained HTML: all CSS and JS inline in StringBuilder output — no external file references"
+    - "RFC 4180 CSV escaping: every field double-quoted, internal quotes doubled"
+    - "External user detection: #EXT# substring check applied to UserLogins for CSS class annotation"
+
+key-files:
+  created: []
+  modified:
+    - SharepointToolbox/Services/Export/CsvExportService.cs
+    - SharepointToolbox/Services/Export/HtmlExportService.cs
+
+key-decisions:
+  - "CsvExportService uses UTF-8 with BOM (encoderShouldEmitUTF8Identifier=true) for Excel compatibility"
+  - "HtmlExportService uses UTF-8 without BOM for HTML files (standard browser expectation)"
+  - "HtmlEncode helper implemented inline rather than using System.Web.HttpUtility to avoid WPF dependency issues"
+  - "User pills zip UserLogins and Users arrays by index position to associate login with display name"
+
+patterns-established:
+  - "Export services accept IReadOnlyList<PermissionEntry> — no direct file system coupling in BuildXxx methods"
+  - "WriteAsync wraps BuildXxx for testability — BuildXxx returns string, WriteAsync does I/O"
+
+requirements-completed: [PERM-05, PERM-06]
+
+# Metrics
+duration: 1min
+completed: 2026-04-02
+---
+
+# Phase 2 Plan 04: Export Services Summary
+
+**CsvExportService with Merge-PermissionRows GroupBy logic and HtmlExportService with inline CSS/JS stats report — both implementing PERM-05 and PERM-06**
+
+## Performance
+
+- **Duration:** 1 min
+- **Started:** 2026-04-02T11:58:05Z
+- **Completed:** 2026-04-02T12:00:00Z
+- **Tasks:** 2
+- **Files modified:** 2
+
+## Accomplishments
+
+- CsvExportService ports PowerShell Merge-PermissionRows: groups entries by (Users, PermissionLevels, GrantedThrough), pipe-joins duplicate URLs and Titles, writes RFC 4180-escaped CSV with UTF-8 BOM
+- HtmlExportService ports Export-PermissionsToHTML: self-contained HTML with stats cards, color-coded object-type badges, unique/inherited badges, user pills with external-user class for #EXT# logins, and inline JS filter
+- All 6 export tests pass (3 CSV + 3 HTML); full suite: 59 pass, 4 skip, 0 fail
+
+## Task Commits
+
+Each task was committed atomically:
+
+1. **Task 1: Implement CsvExportService** - `44913f8` (feat)
+2. **Task 2: Implement HtmlExportService** - `e3ab319` (feat)
+
+**Plan metadata:** (docs: complete plan — see final commit)
+
+_Note: TDD tasks — tests were stubs from Plan 01 (RED). Implementation done in this plan (GREEN)._
+
+## Files Created/Modified
+
+- `SharepointToolbox/Services/Export/CsvExportService.cs` - Merges PermissionEntry rows and writes RFC 4180 CSV with UTF-8 BOM
+- `SharepointToolbox/Services/Export/HtmlExportService.cs` - Generates self-contained interactive HTML report with inline CSS/JS
+
+## Decisions Made
+
+- CsvExportService uses UTF-8 with BOM (`encoderShouldEmitUTF8Identifier: true`) so Excel opens the file correctly without encoding prompts
+- HtmlExportService uses UTF-8 without BOM (standard for HTML, browsers do not expect BOM)
+- Minimal `HtmlEncode` helper implemented inline (replaces &, <, >, ", ') rather than pulling in `System.Web` — avoids adding a dependency and keeps the class self-contained
+- User pills zip `UserLogins` and `Users` by index — this matches the semicolon-delimited parallel arrays established in PermissionEntry design
+
+## Deviations from Plan
+
+None - plan executed exactly as written.
+
+## Issues Encountered
+
+None - both services compiled and all tests passed on first attempt.
+
+## User Setup Required
+
+None - no external service configuration required.
+
+## Next Phase Readiness
+
+- CsvExportService and HtmlExportService are fully implemented and tested (PERM-05, PERM-06 complete)
+- Both services are ready to be wired into the PermissionsViewModel export commands (upcoming plan in wave 3)
+- No blockers for continuing Phase 2
+
+---
+*Phase: 02-permissions*
+*Completed: 2026-04-02*