- RPT-03-f: mergePermissions=false produces byte-identical output to default call - RPT-03-g: mergePermissions=true writes consolidated header and merged rows - Edge case: single-location entry has LocationCount=1 with no semicolons in Locations
- UserAccessCsvExportServiceTests (5): summary section, data header, RFC 4180 quote escaping, 7-column count, WriteSingleFileAsync multi-user output - UserAccessHtmlExportServiceTests (7): DOCTYPE, stats cards, dual-view sections, access type badges, filterTable JS, toggleView JS, HTML entity encoding - UserAccessAuditViewModelTests (8): AuditUsersAsync invocation, results population, summary properties computation, tenant switch reset, GlobalSitesChanged update, override guard, CanExport false/true states