I am able to reproduce your issues with the diff from cart ui and have filed a bug and identified a fix for it. The issue is that if the combo box is disabled, it remains disabled and the only way to get it enabled again is to restart sqldev.
When diffing between two carts, the connection that is used for the add to cart is used for the authorization so if you add it to the cart from user3, user3 will be used for permissions. This is the intended behavior. have also filed a bug for the error message with "null" for the connection.
Thank you very much Joyce
For point 2: user3 has required permission to read catalog and Export Cart for schema2(or schema1) works fine. It is during Diff that tables are assumed to be owned by user3