[dev-belly]

Problem

A completed workpaper could pass validation with a NUL and extra text inside a voucher ID. The default CSV parser truncated that field. It also padded short rows with empty fields, so an omitted review cell could pass.

Change

• Decode the original and completed CSV snapshots as UTF-8 with optional BOM. Read quoted fields with their original text and require the header width on every record.
• Reject NUL in reviewer-entered fields. Keep comparing the original selection values before counting outcomes by route.
• Cover hidden voucher and evidence suffixes and missing or extra fields in the workpaper tests.

Validation

• 57 targeted tests and Ruff passed locally.
• The CLI accepted a filled copy of the committed 300-voucher workpaper saved with BOM and CRLF, quoted Chinese evidence and multiline notes. It rejected the corrupted copies and preserved the prior summary.