fix: read-only invitees auto-join passive

tmux refuses new-session from read-only clients ('client is
read-only'), so an active join for an -r invitee died under set -eu
with a raw tmux error. Detect the R flag on the caller's ACL line in
the existing preflight and fall back to the mirrored view.

party

@@ -949,12 +949,29 @@ EOF
 
     # Auth gate. The joiner must already be on the access list (added
     # by the host via `party invite`). Pre-flight here so the user gets
-    # a helpful message instead of an opaque tmux refusal.
-    if ! "$PARTY_TMUX" -S "$RR_SOCKET" server-access -l 2>/dev/null \
-            | awk '{print $1}' | grep -qx "$USER"; then
+    # a helpful message instead of an opaque tmux refusal. For an
+    # unauthorized caller server-access -l prints its refusal on stderr
+    # with EMPTY stdout (and exit 0 — see party_conn_state), so the awk
+    # match comes up empty and we land in the exit-13 branch.
+    acl_line=$("$PARTY_TMUX" -S "$RR_SOCKET" server-access -l 2>/dev/null \
+        | awk -v u="$USER" '$1 == u { print; exit }')
+    if [ -z "$acl_line" ]; then
         echo "party: '$RR_PARTY_NAME', ask $RR_HOST_USER to invite you." >&2
         exit 13
     fi
+    # Read-only invitees cannot create the guest session: tmux refuses
+    # with "client is read-only" (verified 3.3a/3.5a), which would kill
+    # an active join mid-new-session under set -eu. Detect the R flag
+    # on our own ACL line and take the mirrored view instead. Flag
+    # format is "user (R)" on 3.3–3.5 and "user (U,R)" on newer tmux;
+    # both end the flag list in "R)".
+    case "$acl_line" in
+        *"R)"*)
+            if [ "$passive" != 1 ]; then
+                echo "party: you are read-only on '$RR_PARTY_NAME'; joining passive (mirrored view)." >&2
+                passive=1
+            fi ;;
+    esac
 
     if [ "$passive" = 1 ]; then
         # Mirror the host's pane focus, read-only at the tmux client