diff --git a/party b/party
index f2812c7..1c26b0e 100755
--- a/party
+++ b/party
@@ -482,7 +482,13 @@ party_self_path() {
         /*)  printf '%s\n' "$0" ;;
         */*) printf '%s/%s\n' "$(cd "$(dirname "$0")" && pwd)" \
                               "$(basename "$0")" ;;
-        *)   command -v "$0" 2>/dev/null || printf '%s\n' "$0" ;;
+        *)   _sp=$(command -v "$0" 2>/dev/null) || _sp="$0"
+             # command -v may itself answer relatively (PATH with "." or
+             # an empty entry); anchor those to cwd like the */* case.
+             case "$_sp" in
+                 /*) printf '%s\n' "$_sp" ;;
+                 *)  printf '%s/%s\n' "$PWD" "$_sp" ;;
+             esac ;;
     esac
 }
 
@@ -500,8 +506,9 @@ tmux_party_setup_server() {
     # was hosted with — a bare `tmux` from the server's PATH may be a
     # different, older binary than $PARTY_TMUX, which is the whole reason
     # PARTY_TMUX exists. The second (quoted) is the static body. A
-    # PARTY_TMUX containing a double quote or $ would break the pin;
-    # that's accepted — it's the host's own env var on their own party.
+    # PARTY_TMUX containing a double quote, $, or backslash would break
+    # the pin; that's accepted — it's the host's own env var on their
+    # own party.
     cat > "$notify_script" <<EOF
 #!/bin/sh
 tmux="$PARTY_TMUX"
@@ -526,7 +533,8 @@ EOF
     "$PARTY_TMUX" -S "$sock" set-option  -s exit-empty       on
     party_self=$(party_self_path)
     # The #() body is run by the tmux server via sh, so the embedded
-    # paths are single-quoted — a path containing a single quote is
+    # paths are single-quoted — a path containing a single quote, a `)`,
+    # or `#{` (tmux's #() parser ends at the first unescaped `)`) is
     # accepted breakage (host's own install path).
     "$PARTY_TMUX" -S "$sock" set-option  -g status-right \
         "party: #('$party_self' who --short --socket '$sock' 2>/dev/null)"
diff --git a/tests/96-unauthorized.bats b/tests/96-unauthorized.bats
index 69eef9e..42970d6 100644
--- a/tests/96-unauthorized.bats
+++ b/tests/96-unauthorized.bats
@@ -107,3 +107,25 @@ STUB
   [[ "$output" == *"read-only"* ]]
   [[ "$output" == *"attach-session -r -t fiesta"* ]]
 }
+
+@test "read-only invitee (U,R) flag format also falls back to passive" {
+  # tmux refuses new-session from a read-only client ("client is
+  # read-only", exit 1 — verified 3.3a/3.5a), so an active join for an
+  # -r invitee died mid-command under set -eu. cmd_join must detect the
+  # R flag on its own ACL line and attach passive instead. The unquoted
+  # STUB delimiter is deliberate: $USER expands at write time, \$* at
+  # run time.
+  cat > "$PARTY_TMP/tmux-ro" <<STUB
+#!/bin/sh
+case "\$*" in
+  *"server-access -l"*) printf '%s (U,R)\nsomehost (W)\n' "$USER"; exit 0 ;;
+esac
+exit 0
+STUB
+  chmod +x "$PARTY_TMP/tmux-ro"
+  export PARTY_TMUX="$PARTY_TMP/tmux-ro"
+  PARTY_DRY_RUN=1 run "$PARTY_BIN" join fiesta
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"read-only"* ]]
+  [[ "$output" == *"attach-session -r -t fiesta"* ]]
+}