@@ -114,7 +114,7 @@ fi
 [[ -z "${CANCELLED:-}" ]] || row "Their runs cancelled" "${CANCELLED//,/, }"
 [[ -z "${FINISHED:-}" ]] || row "**Upstream runs that finished before a sweep could stop them**" "${FINISHED//,/, }"
 [[ -z "${UNREGISTERED:-}" ]] \
-  || row "**Upstream workflow files new on this release that GitHub does not list yet, so not disabled** (the sweep after an event reaches them disables them; the branch move waits for that)" "${UNREGISTERED//,/, }"
+  || row "**Upstream workflow files new or changed on this release that GitHub does not list yet, so not disabled** (the sweep after an event reaches them disables them; the branch move waits for that)" "${UNREGISTERED//,/, }"
 [[ -z "${DROPPED:-}" ]] || row "Patches dropped (empty on $BASE_TAG: upstream has the change)" "${DROPPED//;/, }"
 
 reasons=""
 
@@ -24,9 +24,10 @@
 #   dropped        subjects of patches that became empty on the new base (';'-separated)
 #   own_workflows  workflow files the series itself adds (','-separated); every other one is
 #                  upstream's and gets disabled
-#   new_workflows  upstream workflow files added between the series' old base and the new one
-#                  (','-separated; empty without a new base). The branch move refuses while one of
-#                  them is not listed by GitHub yet, so it cannot be disabled before main has it.
+#   new_workflows  upstream workflow files added or changed between the series' old base and the
+#                  new one (','-separated; empty without a new base). The branch move refuses while
+#                  one of them is not listed by GitHub yet, so it cannot be disabled before main has
+#                  it (a changed file may now run on push).
 set -Eeuo pipefail
 
 : "${UPSTREAM:?owner/name of the upstream repository}"
@@ -152,12 +153,35 @@ latest_release() {
   [[ -z "$last" ]] || echo "$last $(git rev-parse "refs/fork-tags/$last^{commit}")"
 }
 
-own_workflows() {
-  git diff --name-only --diff-filter=A "$1" "$2" -- .github/workflows | paste -sd, -
+# Workflow paths, read NUL-separated with core.quotepath=off, so a name with non-ASCII bytes, a
+# quote or a backslash comes out as GitHub lists it. The lists are ','-joined, so a name with a ','
+# or a newline cannot be named and the plan refuses it. These run in the plan's own shell (no
+# command substitution), so a refusal stops the plan.
+workflow_paths() { # workflow_paths FILTER FROM TO: sets paths, the ','-joined files FROM..TO shows as FILTER
+  local path
+  paths=""
+  git -c core.quotepath=off diff -z --no-renames --name-only --diff-filter="$1" "$2" "$3" -- .github/workflows \
+    > "$logs/paths" || fail "Could not list the workflow files that differ between ${2:0:12} and ${3:0:12}."
+  while IFS= read -r -d '' path; do
+    if [[ "$path" == *[,$'\n']* ]]; then
+      fail "The workflow file \`$path\` (between ${2:0:12} and ${3:0:12}) has a ',' or a newline in its name, so it cannot be named to the workflow sweep." \
+        "The series was left as it is. Rename or delete it with a fork patch."
+    fi
+    paths+="${paths:+,}$path"
+  done < "$logs/paths"
+}
+own_workflows() { # own_workflows UPSTREAM_COMMIT TIP: sets own_list, the workflow files the series adds
+  workflow_paths A "$1" "$2"
+  own_list="$paths"
 }
-new_workflows() { # upstream workflow files added from upstream commit $1 to $2 (a rename counts as new)
-  git diff --no-renames --name-only --diff-filter=A "$1" "$2" -- .github/workflows \
-    | { grep -E '\.ya?ml$' || true; } | paste -sd, -
+new_workflows() { # new_workflows FROM TO: sets new_list, the upstream workflow files added or changed
+  local path list=()
+  workflow_paths AM "$1" "$2" # a rename counts as new
+  IFS=, read -r -a list <<< "$paths"
+  new_list=""
+  for path in "${list[@]}"; do
+    [[ "$path" != *.yml && "$path" != *.yaml ]] || new_list+="${new_list:+,}$path"
+  done
 }
 
 # The sweep (fork-workflows.sh) takes every .github/workflows/fork-*.y[a]ml as the fork's own, even
@@ -231,13 +255,14 @@ if [[ "$target_tag" == "$base_tag" ]]; then
       stage_report "$head" "$base_tag" "$changed"
     fi
   fi
+  own_workflows "$base" HEAD
   {
     echo "action=$action"
     echo "base_tag=$base_tag"
     echo "base_commit=$base"
     echo "candidate=$head"
     echo "released_tag=${released_tag:-}"
-    echo "own_workflows=$(own_workflows "$base" HEAD)"
+    echo "own_workflows=$own_list"
     echo "new_workflows="
   } >> "$OUTPUT"
   exit 0
@@ -280,6 +305,8 @@ else
     stage_report "$candidate" "$target_tag" "$changed"
   fi
 fi
+own_workflows "$target" "$candidate"
+new_workflows "$base" "$target"
 {
   echo "action=$action"
   echo "base_tag=$target_tag"
@@ -289,6 +316,6 @@ fi
   echo "candidate=$candidate"
   echo "released_tag=${released_tag:-}"
   echo "dropped=$dropped"
-  echo "own_workflows=$(own_workflows "$target" "$candidate")"
-  echo "new_workflows=$(new_workflows "$base" "$target")"
+  echo "own_workflows=$own_list"
+  echo "new_workflows=$new_list"
 } >> "$OUTPUT"
@@ -313,6 +313,24 @@ check "plan: same base with an upstream fork-*.yml is refused too" \
 plan
 check "plan: a fork patch that deletes the upstream fork-*.yml lets the plan go on" action_is release
 
+# Round 4: a changed upstream workflow counts like a new one (an unlisted file that now runs on push
+# must hold the move too), and a non-ASCII name comes out as GitHub lists it, not quoted by git.
+new_upstream
+(cd "$root/upwork" && git checkout -q main && echo "on: [push] # changed" > .github/workflows/ci.yml \
+  && echo "on: push" > .github/workflows/dé.yml && git add -A && git commit -q -m u5 \
+  && git tag v0.1.11 && git push -q https://github.com/up/t3code.git main --tags) > /dev/null 2>&1
+new_fork v0.1.10
+plan
+check "plan: a changed upstream workflow and a non-ASCII new one are both named, unquoted" \
+  eval 'action_is rebase && [[ "$(out new_workflows)" == ".github/workflows/ci.yml,.github/workflows/dé.yml" ]]'
+new_upstream
+(cd "$root/upwork" && git checkout -q main && echo "on: push" > ".github/workflows/a,b.yml" && git add -A \
+  && git commit -q -m u5 && git tag v0.1.11 && git push -q https://github.com/up/t3code.git main --tags) > /dev/null 2>&1
+new_fork v0.1.10
+plan
+check "plan: a new upstream workflow with ',' in its name (cannot be listed) is refused, nothing planned" \
+  eval '[[ -z "$(out action)" ]] && has "a,b.yml" "$root/report.md" && has "cannot be named" "$root/report.md" && hasnt "plan stopped at" "$root/report.md"'
+
 # Minor: upstream changed a reusable workflow the release calls; the run's own copy is older.
 new_upstream
 (cd "$root/upwork" && git checkout -q main && echo "on: workflow_call # v2" > .github/workflows/release-desktop.yml \
@@ -503,7 +521,7 @@ check "workflows: an unlisted upstream file from an earlier release is named apa
 rm -f "$root/api/writes"
 OWN_WORKFLOWS=.github/workflows/fork-follow.yml,.github/workflows/fork-tests.yml HEAD_SHA=abc NEW_WORKFLOWS=.github/workflows/release.yml sweep
 check "workflows: an unlisted upstream file new on this release is named with a warning, not called disabled" \
-  eval '[[ "$(sed -n "s/^unregistered=//p" "$root/sweep.out")" == ".github/workflows/release.yml" && -z "$(sed -n "s/^unregistered_old=//p" "$root/sweep.out")" ]] && has "::warning::.*new on this release.*does not list yet" "$root/out"'
+  eval '[[ "$(sed -n "s/^unregistered=//p" "$root/sweep.out")" == ".github/workflows/release.yml" && -z "$(sed -n "s/^unregistered_old=//p" "$root/sweep.out")" ]] && has "::warning::.*new or changed on this release.*does not list yet" "$root/out"'
 rm -f "$root/api/writes" "$root/report.md"
 check "workflows: before the move, a new unlisted upstream file refuses it, after disabling the listed ones" \
   eval '! OWN_WORKFLOWS=.github/workflows/fork-follow.yml HEAD_SHA=abc NEW_WORKFLOWS=.github/workflows/release.yml REQUIRE_NEW_OFF=true sweep && has "main was not moved" "$root/report.md" && has "release.yml" "$root/report.md" && has "A person decides" "$root/report.md" && has "workflows/2/disable" "$root/api/writes"'
 
@@ -6,8 +6,8 @@
 #   finished      runs of upstream workflows that completed since SINCE (they ran before a sweep
 #                 could stop them), with their conclusion
 #   unregistered  upstream workflow files in the tree at TREE_REF that GitHub does not list yet
-#                 and that are new on this upstream release (NEW_WORKFLOWS). GitHub lists a
-#                 workflow only once an event has reached its file, so these can be neither
+#                 and that are new or changed on this upstream release (NEW_WORKFLOWS). GitHub
+#                 lists a workflow only once an event has reached its file, so these can be neither
 #                 disabled nor cancelled until then; the next sweep after that event does.
 #   unregistered_old  the other unlisted upstream files, from earlier releases. Most of them run
 #                 only on events the fork never sends (workflow_call, workflow_dispatch,
@@ -18,7 +18,7 @@
 #
 # Environment: REPOSITORY (owner/name; GITHUB_REPOSITORY in a run), OWN_WORKFLOWS (','-separated
 # paths the fork's own commits add; required, nothing is guessed), NEW_WORKFLOWS (','-separated
-# upstream files added since the series' old base; optional), REQUIRE_NEW_OFF (true: fail when one
+# upstream files added or changed since the series' old base; optional), REQUIRE_NEW_OFF (true: fail when one
 # of NEW_WORKFLOWS is in the tree and not listed, because then it cannot be disabled before the
 # series branch has it), TREE_REF (commit or branch whose workflow files are checked; default
 # HEAD_SHA, else SERIES_BRANCH, else main), HEAD_SHA, SERIES_BRANCH, PREVIOUS_HEAD (the series head
@@ -119,15 +119,15 @@ join() { local IFS=,; echo "$*"; }
 ((${#finished[@]} == 0)) \
   || echo "::warning::Upstream workflow runs finished before they could be stopped: $(join "${finished[@]}")" >&2
 ((${#unregistered[@]} == 0)) \
-  || echo "::warning::Upstream workflow files new on this release that GitHub does not list yet, so not disabled: $(join "${unregistered[@]}")" >&2
+  || echo "::warning::Upstream workflow files new or changed on this release that GitHub does not list yet, so not disabled: $(join "${unregistered[@]}")" >&2
 echo "Upstream workflows disabled: ${#disabled[@]}; runs cancelled: ${#cancelled[@]}; finished before a sweep: ${#finished[@]}; new and not registered yet: ${#unregistered[@]}; older and not registered: ${#unregistered_old[@]}." >&2
 
 # Before the series branch moves: any workflow file on it may ask for the Environment that holds
 # FORK_PUSH_TOKEN, and the push starts its push workflows before a later sweep can stop them. A
 # new upstream file that GitHub does not list cannot be disabled first, so a person decides.
 if [[ "${REQUIRE_NEW_OFF:-}" == true ]] && ((${#unregistered[@]})); then
   branch="${SERIES_BRANCH:-main}"
-  die "$branch was not moved: upstream workflow files that are new on this release are not listed by GitHub yet, so they could not be disabled before $branch gets them:" \
+  die "$branch was not moved: upstream workflow files that are new or changed on this release are not listed by GitHub yet, so they could not be disabled before $branch gets them:" \
     "$(printf -- '- `%s`\n' "${unregistered[@]}")" "" \
     "On $branch, a push starts their push workflows before a sweep can stop them, and any workflow file there may ask for the Environment that holds FORK_PUSH_TOKEN." \
     "A person decides. Read them in the candidate (\`git show ${TREE_REF:0:12}:<file>\`). If they are harmless, move $branch to $TREE_REF yourself" \
 
@@ -22,9 +22,9 @@ name: Fork follow upstream
 # fork-workflows.sh disables every active workflow the series did not add (a fork-*.yml is always the
 # fork's own, also before main has it; the plan refuses an upstream release that has one), cancels
 # every unfinished run of one (any event), and names the runs that finished before it could stop
-# them and the files GitHub has not listed yet. The branch move is refused while an upstream workflow file that is new
-# on this release is not listed (it could not be disabled, and on the branch it could ask for
-# fork-push); a person decides then.
+# them and the files GitHub has not listed yet. The branch move is refused while an upstream
+# workflow file that is new or changed on this release is not listed (it could not be disabled, and
+# on the branch it could ask for fork-push); a person decides then.
 #
 # A re-run of failed jobs (or of one job) keeps the Guard job's earlier result, so the jobs with
 # the token are skipped unless the guard passed in this attempt: use "Re-run all jobs".
@@ -290,7 +290,8 @@ jobs:
 
       # Any workflow file on the series branch may ask for fork-push, and the move fires its push
       # workflows. So upstream workflows are disabled first, and the move is refused while an
-      # upstream file new on this release is not listed by GitHub (it cannot be disabled yet).
+      # upstream file new or changed on this release is not listed by GitHub (it cannot be
+      # disabled yet).
       - id: sweep_before
         name: Disable upstream workflows before the move, refuse while a new one cannot be
         env: