Bound NYM mixnet request concurrency and timeout

Measured on a throttled Android emulator with the request logging from the
previous commit: a single Avalanche wallet opens 12 concurrent mixnet requests
during one sync. mix-fetch v1 has a history of serving one request per host at
a time, which this module used to work around with a per-host queue removed in
5916d9d on the understanding that 1.4.2 had fixed it.

Cap the mixnet at 6 concurrent requests overall and 2 per host, queueing the
rest. Measured before and after on the same emulator against the live mixnet:
peak in-flight drops from 12 to 6, per-request latency is unchanged (p50 2666ms
vs 2669ms), and every request still settles.

Also drop the per-request timeout from 300s to 60s. Healthy requests measure
2-4 seconds, so five minutes only ever meant that a request the mixnet never
answered pinned its caller for five minutes. On the send screen that is the
'Calculating Fee' spinner that QA reports as an infinite hang.

Neither change touches the request logging, which is still needed to attribute
the remaining NYM-internal failure.

Author: j0ntz

CHANGELOG.md

@@ -3,6 +3,8 @@
 ## Unreleased
 
 - added: Log the lifecycle of every NYM mixnet request (method, host, path, duration, HTTP status or error, and in-flight count), plus mixFetch setup timing. A request that logs a start with no terminal line identifies the host whose request never returned, which the previous logging could not attribute. These log at `warn` so they survive the default `warn` log level and appear in a log export without the user first enabling verbose logging.
+- fixed: Bound NYM mixnet requests to 6 concurrent overall and 2 per host. A single Avalanche wallet was measured opening 12 concurrent mixnet requests during one sync, and a full wallet list multiplies that; mix-fetch v1 has a history of serving one request per host at a time.
+- fixed: Reduce the NYM per-request timeout from 300 seconds to 60. At five minutes, a request the mixnet never answered held the send screen on "Calculating Fee" long enough to read as a permanent hang rather than an error.
 
 ## 2.47.1 (2026-07-17)
 

src/util/nym.ts

@@ -18,10 +18,29 @@ export const mixFetchOptions: SetupMixFetchOps = {
     '5x6q9UfVHs5AohKMUqeivj7a556kVVy7QwoKige8xHxh.6CFoB3kJaDbYz6oafPJxNxNjzahpT2NtgtytcSyN9EvF@5rXcNe2a44vXisK3uqLHCzpzvEwcnsijDMU7hg4fcYk8',
   forceTls: true, // force WSS
   mixFetchOverride: {
-    requestTimeoutMs: 300000
+    // A healthy mixnet request measures 2-4 seconds. The previous 300000 (5
+    // minutes) meant any request the mixnet never answered held its caller for
+    // five minutes, which on the send screen reads as a permanently stuck
+    // "Calculating Fee" spinner rather than an error.
+    requestTimeoutMs: 60000
   }
 }
 
+/**
+ * Ceilings on how many requests are in the mixnet at once.
+ *
+ * mix-fetch v1 historically served one request per host at a time, which this
+ * module used to work around with a per-host queue. That queue was removed in
+ * 5916d9d2 on the understanding that 1.4.2 had fixed the limitation. Measured
+ * on an Android emulator, a single Avalanche wallet still opens 12 concurrent
+ * requests during one sync, and a wallet list the size of a real user's
+ * multiplies that. Bounding it keeps the tunnel inside a regime we have
+ * actually observed working, at a negligible cost given each request already
+ * takes seconds.
+ */
+const MAX_IN_FLIGHT_TOTAL = 6
+const MAX_IN_FLIGHT_PER_HOST = 2
+
 /**
  * Budget for `createMixFetch` itself (client start + gateway handshake).
  *
@@ -43,6 +62,64 @@ let inFlightCount = 0
 // Distinguishes concurrent requests to the same host in the log.
 let requestCounter = 0
 
+// Requests waiting on a concurrency slot, oldest first.
+const waiting: Array<() => void> = []
+
+// In-flight count per host key, for the per-host ceiling.
+const hostInFlight = new Map<string, number>()
+
+/**
+ * The `host:port` a request will actually open, used to key the per-host
+ * ceiling. Falls back to the raw uri so an unparsable one still gets queued
+ * rather than bypassing the limit.
+ */
+function getHostKey(uri: string): string {
+  try {
+    const url = new URL(uri)
+    const port =
+      url.port !== '' ? url.port : url.protocol === 'https:' ? '443' : '80'
+    return `${url.hostname}:${port}`
+  } catch (error: unknown) {
+    return uri
+  }
+}
+
+function hasSlot(hostKey: string): boolean {
+  return (
+    inFlightCount < MAX_IN_FLIGHT_TOTAL &&
+    (hostInFlight.get(hostKey) ?? 0) < MAX_IN_FLIGHT_PER_HOST
+  )
+}
+
+/**
+ * Wait until this request is allowed into the mixnet, then reserve its slot.
+ */
+async function acquireSlot(hostKey: string): Promise<void> {
+  while (!hasSlot(hostKey)) {
+    await new Promise<void>(resolve => waiting.push(resolve))
+  }
+  inFlightCount += 1
+  hostInFlight.set(hostKey, (hostInFlight.get(hostKey) ?? 0) + 1)
+}
+
+/**
+ * Release this request's slot and wake everyone waiting.
+ *
+ * Every waiter re-checks its own host ceiling in `acquireSlot`, so waking all
+ * of them is correct: the ones still blocked simply queue again. Waking only
+ * the head would stall the queue whenever the head is blocked on a busy host
+ * while a slot for some other host just came free.
+ */
+function releaseSlot(hostKey: string): void {
+  inFlightCount -= 1
+  const remaining = (hostInFlight.get(hostKey) ?? 1) - 1
+  if (remaining <= 0) hostInFlight.delete(hostKey)
+  else hostInFlight.set(hostKey, remaining)
+
+  const woken = waiting.splice(0, waiting.length)
+  for (const wake of woken) wake()
+}
+
 /**
  * A path segment that is long and unbroken enough to be an identifier rather
  * than a route: an address, a txid, a public key, or an API key. Real route
@@ -176,8 +253,24 @@ export async function nymFetch(
   const method = opts.method ?? 'GET'
   const label = `mixFetch #${id} ${method} ${target}`
 
+  const hostKey = getHostKey(uri)
+  const queuedAt = Date.now()
+  await acquireSlot(hostKey)
+  const queuedMs = Date.now() - queuedAt
+
   const start = Date.now()
-  log.warn(`${label} start (${++inFlightCount} in flight)`)
+  log.warn(
+    `${label} start (${inFlightCount} in flight${
+      queuedMs > 0 ? `, queued ${queuedMs}ms` : ''
+    })`
+  )
+  let released = false
+  const release = (): void => {
+    if (released) return
+    released = true
+    releaseSlot(hostKey)
+  }
+
   try {
     const response = await mixFetch(
       uri,
@@ -187,17 +280,19 @@ export async function nymFetch(
       },
       mixFetchOptions
     )
+    release()
     log.warn(
       `${label} -> ${response.status} in ${
         Date.now() - start
-      }ms (${--inFlightCount} in flight)`
+      }ms (${inFlightCount} in flight)`
     )
     return response
   } catch (error: unknown) {
+    release()
     log.error(
       `${label} failed after ${
         Date.now() - start
-      }ms (${--inFlightCount} in flight): ${describeError(error)}`
+      }ms (${inFlightCount} in flight): ${describeError(error)}`
     )
     throw error
   }