fix(mesh): Reticulum resource transfers actually deliver — 4 root causes

E2E-verified both directions dev-box<->x250 over real RF (5KB image ~60s):

1. Sender daemon never called link.identify() — receiver's
   get_remote_identity() was None, so every arrived transfer carried an
   empty source_hash and the Rust side dropped it (now also warns
   instead of silently vanishing it).
2. Receiver treated resource.data as bytes, but RNS hands a concluded
   Resource's data as a file-like BufferedReader — b64encode raised
   TypeError and the transfer was lost even when attributed.
3. Radio twins of merged contacts carry the peer's Archipelago ed25519
   key as pubkey_hex, not an RNS hash — prefix lookup could never match
   ('Unknown Reticulum prefix', observed live). resolve_dest_hash now
   falls back to matching the announce-bound arch_pubkey_hex.
4. The daemon RPC socket kept asyncio's default 64KiB line limit; any
   attachment >~48KB overflowed it and tore down the whole daemon
   connection ('reticulum-daemon is gone'). Raised to 16MiB.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

reticulum-daemon/reticulum_daemon.py

@@ -437,13 +437,29 @@ class ReticulumDaemon:
             identity, RNS.Destination.OUT, RNS.Destination.SINGLE,
             "archy", "resource",
         )
-        link = RNS.Link(out_dest)
+        # established_callback identifies us to the peer BEFORE any Resource
+        # goes out: the receiving daemon attributes an inbound resource via
+        # link.get_remote_identity() (see _on_resource_received), which is
+        # None unless the initiator calls identify() — without this every
+        # transfer arrives with an empty source_hash and the Rust side can't
+        # route it to a contact (observed live 2026-07-28: 5KB image sent,
+        # concluded COMPLETE, never surfaced on the receiving node).
+        link = RNS.Link(
+            out_dest,
+            established_callback=lambda lk: self._on_out_link_established(
+                resource_hash, lk
+            ),
+        )
         link.set_link_closed_callback(
             lambda lk: self.links.pop(resource_hash, None)
         )
         self.links[resource_hash] = link
         return link, resource_hash
 
+    def _on_out_link_established(self, resource_hash: bytes, link):
+        link.identify(self.identity)
+        self._flush_pending_resource_sends(resource_hash, link)
+
     def _send_resource(self, req: dict):
         import RNS
         req_id = req.get("id", "")
@@ -463,14 +479,14 @@ class ReticulumDaemon:
         if link.status == RNS.Link.ACTIVE:
             self._start_resource(link, data, req_id)
         else:
-            # Link is establishing — queue and flush from the established
-            # callback. set_link_established_callback only fires once per Link
-            # object (the cache is reused across sends), so re-set it here to
-            # make sure THIS send's queue entry gets flushed too.
+            # Link is establishing — queue; the creation-time established
+            # callback (_on_out_link_established) identifies us then flushes
+            # the queue. Re-check afterwards to close the race where the
+            # link went ACTIVE between the status check and the append
+            # (the callback fires once, on the RNS thread).
             self.pending_resource_sends[resource_hash].append((data, req_id))
-            link.set_link_established_callback(
-                lambda lk: self._flush_pending_resource_sends(resource_hash, lk)
-            )
+            if link.status == RNS.Link.ACTIVE:
+                self._flush_pending_resource_sends(resource_hash, link)
 
     def _flush_pending_resource_sends(self, resource_hash: bytes, link):
         import RNS
@@ -518,10 +534,17 @@ class ReticulumDaemon:
                 RNS.Destination.hash(identity, "lxmf", "delivery").hex()
                 if identity is not None else ""
             )
+            # RNS hands a concluded Resource's data as a file-like object
+            # (BufferedReader over the assembled stream), not bytes —
+            # observed live 2026-07-28: b64encode raised "a bytes-like
+            # object is required" and every received transfer was lost.
+            data = resource.data
+            if hasattr(data, "read"):
+                data = data.read()
             self._emit_threadsafe({
                 "event": "resource_recv",
                 "source_hash": source_hash,
-                "data_b64": base64.b64encode(resource.data).decode("ascii"),
+                "data_b64": base64.b64encode(data).decode("ascii"),
             })
         except Exception as e:  # never let a callback kill the RNS thread
             self._emit_threadsafe({"event": "error", "where": "resource_recv",
@@ -531,7 +554,14 @@ class ReticulumDaemon:
         sock_path = self.args.socket
         if os.path.exists(sock_path):
             os.unlink(sock_path)
-        server = await asyncio.start_unix_server(self._handle_client, path=sock_path)
+        # limit: asyncio's default per-line StreamReader cap is 64KiB, but
+        # send_resource requests carry the whole payload base64-encoded on one
+        # JSON line — a ~48KB+ attachment overflows the default and the raised
+        # LimitOverrunError tears down the RPC connection (the Rust side then
+        # sees "reticulum-daemon is gone" and restarts the whole session).
+        server = await asyncio.start_unix_server(
+            self._handle_client, path=sock_path, limit=16 * 1024 * 1024
+        )
         os.chmod(sock_path, 0o600)
         self.announce()
         async with server: