diff --git a/cli/src/main.rs b/cli/src/main.rs
index f5d8838..5cf9b42 100644
--- a/cli/src/main.rs
+++ b/cli/src/main.rs
@@ -3773,7 +3773,17 @@ fn run_hosted_task_worker(
                 Ok(Some(publication)) => {
                     result = augment_hosted_result_with_publication(result, &publication);
                 }
-                Ok(None) => {}
+                // A repository task that changed no files publishes nothing. Say so in the result,
+                // so a finished task without a branch is not mistaken for a publication failure.
+                Ok(None) => {
+                    if payload.base_commit.is_some() {
+                        let note = "No file changes were made, so no branch was published.";
+                        result = Some(match result {
+                            Some(value) if !value.trim().is_empty() => format!("{value}\n\n{note}"),
+                            _ => note.to_string(),
+                        });
+                    }
+                }
                 // The run itself succeeded. The publication failure is recorded in the result.
                 Err(error) => {
                     let note = format!("Publication failed: {error}");
diff --git a/crates/code-runtime/src/file_ops.rs b/crates/code-runtime/src/file_ops.rs
index 3408637..4b472b2 100644
--- a/crates/code-runtime/src/file_ops.rs
+++ b/crates/code-runtime/src/file_ops.rs
@@ -33,9 +33,12 @@ fn validate_workspace_boundary(resolved: &Path, workspace_root: &Path) -> io::Re
         return Err(io::Error::new(
             io::ErrorKind::PermissionDenied,
             format!(
-                "path {} escapes workspace boundary {}",
+                "path {} escapes workspace boundary {}; use a path relative to the workspace, such as {}",
                 resolved.display(),
-                workspace_root.display()
+                workspace_root.display(),
+                resolved
+                    .file_name()
+                    .map_or_else(|| "a relative file name".to_string(), |name| name.to_string_lossy().into_owned()),
             ),
         ));
     }
diff --git a/scripts/linux-amd64-worker-e2e.sh b/scripts/linux-amd64-worker-e2e.sh
index eac5fab..e777b0a 100755
--- a/scripts/linux-amd64-worker-e2e.sh
+++ b/scripts/linux-amd64-worker-e2e.sh
@@ -77,7 +77,7 @@ done
 curl -sf -H "authorization: Bearer $KEY" "http://127.0.0.1:$PORT/v1/version" >/dev/null \
   || { echo "error: server did not start"; docker logs "$CONTAINER" 2>&1 | tail -30; exit 1; }
 
-PROMPT="Create a file named published.txt in the current directory containing exactly: from the linux worker. Reply DONE."
+PROMPT="Create a file named published.txt in the current directory (use the relative path published.txt, never an absolute path) containing exactly: from the linux worker. Reply DONE."
 IDS=()
 for n in 1 2; do
   BRANCH="frontal-code/linux-e2e-$n"
diff --git a/scripts/worker-e2e.sh b/scripts/worker-e2e.sh
index ef19bcb..136c2bb 100755
--- a/scripts/worker-e2e.sh
+++ b/scripts/worker-e2e.sh
@@ -32,7 +32,7 @@ WORK="$(mktemp -d "${TMPDIR:-/tmp}/frontal-worker-e2e.XXXXXX")"
 SERVER_LOG="$WORK/server.log"
 API_KEY="e2e-$(date +%s)-$RANDOM"
 STAMP="$(date +%s)"
-PROMPT="${PROMPT:-Create a file named published.txt in the current directory containing exactly: from the worker. Then run: python3 -c 'print(1)'. Then run: curl -m 5 -sS https://example.com -o /dev/null; echo CURL_EXIT=\$?. Then run: rm -rf /tmp/anything; echo RM_EXIT=\$?. Reply with the exit code lines and the word DONE.}"
+PROMPT="${PROMPT:-Create a file named published.txt in the current directory (use the relative path published.txt, never an absolute path) containing exactly: from the worker. Then run: python3 -c 'print(1)'. Then run: curl -m 5 -sS https://example.com -o /dev/null; echo CURL_EXIT=\$?. Then run: rm -rf /tmp/anything; echo RM_EXIT=\$?. Reply with the exit code lines and the word DONE.}"
 
 : "${FRONTAL_CODE_SERVER_DATABASE_URL:?set FRONTAL_CODE_SERVER_DATABASE_URL to a Postgres database}"
 
@@ -55,7 +55,7 @@ git -C "$WORK/seed" -c user.name=seed -c user.email=seed@local commit -q -m init
 git -C "$WORK/seed" push -q "$WORK/remote.git" main
 
 cargo build -q -p code-server --manifest-path "$ROOT/Cargo.toml"
-SERVER_BIN="$ROOT/target/debug/code-server"
+SERVER_BIN="${CARGO_TARGET_DIR:-$ROOT/target}/debug/code-server"
 
 cleanup() {
   if [ -n "${SERVER_PID:-}" ]; then kill "$SERVER_PID" 2>/dev/null || true; fi