Converting from TYPE=RACF to TYPE=ID offers more flexibility, in that ID combines info from BASE and TSO segments, thus obviating the need for SUMMARY or tricks with TMSIZE:
mergelist
newlist type=id
select class=user not(id:protected) id:ljdate<>never id:special
sortlist id("Userid") id:ljdate($date,10) id:passdate($date,10) tso /* many many more fields */
newlist type=id
select class=user id:protected id:ljdate<>never id:special
sortlist id("Userid") id:ljdate($date,10) "NOT USED"(10) tso
/* 2 more newlists printing "NEVER USED" when LJDATE=NEVER */
endmerge
I suppose it will become second nature to use lookups like id:protected, but the select and define functions do the job, so far.
ID needs a CKFREEZE file, that will provide some more challenges compared to just reporting from the active RACF db, now we have to add an ALLOC command for the appropriate CKFREEZE dsn too. So the questions from the OP remain, though at a lower level of urgency.