Bound NYM mixnet request concurrency and timeout

Measured on a throttled Android emulator with the request logging from the
previous commit: a single Avalanche wallet opens 12 concurrent mixnet requests
during one sync. mix-fetch v1 has a history of serving one request per host at
a time, which this module used to work around with a per-host queue removed in
5916d9d on the understanding that 1.4.2 had fixed it.

Cap the mixnet at 6 concurrent requests overall and 2 per host, queueing the
rest. Measured before and after on the same emulator against the live mixnet:
peak in-flight drops from 12 to 6, per-request latency is unchanged (p50 2666ms
vs 2669ms), and every request still settles.

Also drop the per-request timeout from 300s to 60s. Healthy requests measure
2-4 seconds, so five minutes only ever meant that a request the mixnet never
answered pinned its caller for five minutes. On the send screen that is the
'Calculating Fee' spinner that QA reports as an infinite hang.

Neither change touches the request logging, which is still needed to attribute
the remaining NYM-internal failure.

Author: j0ntz

CHANGELOG.md

@@ -3,6 +3,8 @@
 ## Unreleased
 
 - added: Log the lifecycle of every NYM mixnet request (method, host, path, duration, HTTP status or error, and in-flight count), plus mixFetch setup timing. A request that logs a start with no terminal line identifies the host whose request never returned, which the previous logging could not attribute. These log at `warn` so they survive the default `warn` log level and appear in a log export without the user first enabling verbose logging.
+- changed: Bound NYM mixnet requests to 6 concurrent overall and 2 per host. A single Avalanche wallet was measured opening 12 concurrent mixnet requests during one sync, and a full wallet list multiplies that; mix-fetch v1 has a history of serving one request per host at a time.
+- changed: Reduce the NYM per-request timeout from 300 seconds to 60. At five minutes, a request the mixnet never answered held the send screen on "Calculating Fee" long enough to read as a permanent hang rather than an error.
 
 ## 2.47.1 (2026-07-17)
 

src/util/nym.ts

@@ -18,10 +18,40 @@ export const mixFetchOptions: SetupMixFetchOps = {
     '5x6q9UfVHs5AohKMUqeivj7a556kVVy7QwoKige8xHxh.6CFoB3kJaDbYz6oafPJxNxNjzahpT2NtgtytcSyN9EvF@5rXcNe2a44vXisK3uqLHCzpzvEwcnsijDMU7hg4fcYk8',
   forceTls: true, // force WSS
   mixFetchOverride: {
-    requestTimeoutMs: 300000
+    // A healthy mixnet request measures 2-4 seconds. The previous 300000 (5
+    // minutes) meant any request the mixnet never answered held its caller for
+    // five minutes, which on the send screen reads as a permanently stuck
+    // "Calculating Fee" spinner rather than an error.
+    requestTimeoutMs: 60000
   }
 }
 
+/**
+ * Ceilings on how many requests are in the mixnet at once.
+ *
+ * mix-fetch v1 historically served one request per host at a time, which this
+ * module used to work around with a per-host queue. That queue was removed in
+ * 5916d9d2 on the understanding that 1.4.2 had fixed the limitation. Measured
+ * on an Android emulator, a single Avalanche wallet still opens 12 concurrent
+ * requests during one sync, and a wallet list the size of a real user's
+ * multiplies that. Bounding it keeps the tunnel inside a regime we have
+ * actually observed working, at a negligible cost given each request already
+ * takes seconds.
+ */
+const MAX_IN_FLIGHT_TOTAL = 6
+const MAX_IN_FLIGHT_PER_HOST = 2
+
+/**
+ * How long a request will wait for a slot before going anyway.
+ *
+ * The ceilings above are smoothing, not an invariant worth stalling on. If
+ * every slot is held by a request that will not answer, an unbounded queue
+ * would add its own multi-minute delay on top of the per-request timeout and
+ * recreate exactly the stuck "Calculating Fee" this change exists to prevent.
+ * Past this deadline the request proceeds and the log says it did.
+ */
+const MAX_QUEUE_WAIT_MS = 10000
+
 /**
  * Budget for `createMixFetch` itself (client start + gateway handshake).
  *
@@ -43,13 +73,102 @@ let inFlightCount = 0
 // Distinguishes concurrent requests to the same host in the log.
 let requestCounter = 0
 
+// Requests waiting on a concurrency slot, oldest first.
+const waiting: Array<() => void> = []
+
+// In-flight count per host key, for the per-host ceiling.
+const hostInFlight = new Map<string, number>()
+
 /**
- * A path segment that is long and unbroken enough to be an identifier rather
- * than a route: an address, a txid, a public key, or an API key. Real route
- * segments in the endpoints we call (`ext`, `bc`, `C`, `rpc`, `v2`, `api`,
- * `get_address_info`) are short, or contain separators, or both.
+ * The `host:port` a request will actually open, used to key the per-host
+ * ceiling. Falls back to the raw uri so an unparsable one still gets queued
+ * rather than bypassing the limit.
  */
-const IDENTIFIER_SEGMENT = /^(0x)?[0-9a-zA-Z]{20,}$/
+function getHostKey(uri: string): string {
+  try {
+    const url = new URL(uri)
+    const port =
+      url.port !== '' ? url.port : url.protocol === 'https:' ? '443' : '80'
+    return `${url.hostname}:${port}`
+  } catch (error: unknown) {
+    return uri
+  }
+}
+
+function hasSlot(hostKey: string): boolean {
+  return (
+    inFlightCount < MAX_IN_FLIGHT_TOTAL &&
+    (hostInFlight.get(hostKey) ?? 0) < MAX_IN_FLIGHT_PER_HOST
+  )
+}
+
+/**
+ * Wait until this request is allowed into the mixnet, then reserve its slot.
+ *
+ * Returns true when the slot was granted by the ceilings, false when the
+ * deadline elapsed first and the request is proceeding regardless. The slot is
+ * reserved either way, so the counters stay honest.
+ */
+async function acquireSlot(hostKey: string): Promise<boolean> {
+  const deadline = Date.now() + MAX_QUEUE_WAIT_MS
+  let granted = true
+
+  while (!hasSlot(hostKey)) {
+    const remaining = deadline - Date.now()
+    if (remaining <= 0) {
+      granted = false
+      break
+    }
+    let timer: ReturnType<typeof setTimeout> | undefined
+    let wake: () => void = () => {}
+    await new Promise<void>(resolve => {
+      wake = resolve
+      waiting.push(resolve)
+      timer = setTimeout(resolve, remaining)
+    })
+    clearTimeout(timer)
+    // Drop our own resolver. `releaseSlot` drains the whole array, so this
+    // only matters when the deadline fired instead: without it, a stretch
+    // where nothing settles (exactly the case being diagnosed) would grow
+    // `waiting` without bound, since nothing else ever clears it.
+    const index = waiting.indexOf(wake)
+    if (index !== -1) waiting.splice(index, 1)
+  }
+
+  inFlightCount += 1
+  hostInFlight.set(hostKey, (hostInFlight.get(hostKey) ?? 0) + 1)
+  return granted
+}
+
+/**
+ * Release this request's slot and wake everyone waiting.
+ *
+ * Every waiter re-checks its own host ceiling in `acquireSlot`, so waking all
+ * of them is correct: the ones still blocked simply queue again. Waking only
+ * the head would stall the queue whenever the head is blocked on a busy host
+ * while a slot for some other host just came free.
+ */
+function releaseSlot(hostKey: string): void {
+  inFlightCount -= 1
+  const remaining = (hostInFlight.get(hostKey) ?? 1) - 1
+  if (remaining <= 0) hostInFlight.delete(hostKey)
+  else hostInFlight.set(hostKey, remaining)
+
+  const woken = waiting.splice(0, waiting.length)
+  for (const wake of woken) wake()
+}
+
+/**
+ * A path segment long enough to be an identifier rather than a route: an
+ * address, a txid, a public key, or an API key.
+ *
+ * Length is what separates the two, not character set. Route segments in the
+ * endpoints we call are short (`ext`, `bc`, `C`, `rpc`, `v2`, `api`, the
+ * 16-character `get_address_info`), while identifiers run 26 characters and up.
+ * The separator classes matter: hyphens for UUIDs, a colon for cashaddr-style
+ * `prefix:address`, underscores and dots for the rest.
+ */
+const IDENTIFIER_SEGMENT = /^[0-9a-zA-Z][0-9a-zA-Z._:-]{19,}$/
 
 /**
  * Reduce a request URI to the part that is safe to write to a user's log.
@@ -176,8 +295,26 @@ export async function nymFetch(
   const method = opts.method ?? 'GET'
   const label = `mixFetch #${id} ${method} ${target}`
 
+  const hostKey = getHostKey(uri)
+  const queuedAt = Date.now()
+  const granted = await acquireSlot(hostKey)
+  const queuedMs = Date.now() - queuedAt
+
   const start = Date.now()
-  log.warn(`${label} start (${++inFlightCount} in flight)`)
+  const queueNote =
+    queuedMs === 0
+      ? ''
+      : granted
+      ? `, queued ${queuedMs}ms`
+      : `, queued ${queuedMs}ms then went over the limit`
+  log.warn(`${label} start (${inFlightCount} in flight${queueNote})`)
+  let released = false
+  const release = (): void => {
+    if (released) return
+    released = true
+    releaseSlot(hostKey)
+  }
+
   try {
     const response = await mixFetch(
       uri,
@@ -187,17 +324,19 @@ export async function nymFetch(
       },
       mixFetchOptions
     )
+    release()
     log.warn(
       `${label} -> ${response.status} in ${
         Date.now() - start
-      }ms (${--inFlightCount} in flight)`
+      }ms (${inFlightCount} in flight)`
     )
     return response
   } catch (error: unknown) {
+    release()
     log.error(
       `${label} failed after ${
         Date.now() - start
-      }ms (${--inFlightCount} in flight): ${describeError(error)}`
+      }ms (${inFlightCount} in flight): ${describeError(error)}`
     )
     throw error
   }