It waits forever, so plugins should ensure they do any timing out on their side. I have a debugging script that can be used to detect a stalled/missing response. More info in this issue: https://github.com/hoytech/strfry/issues/112

Currently strfry always waits until it gets a response about the previous event before sending another request, so the order is not applicable. Eventually I might make the implementation asynchronous in which case yes, mixed order would be acceptable. This is why the event ID must be included in a plugin reply even though technically it's not needed today. I clarified this in the docs: https://github.com/hoytech/strfry/commit/d2d8dc7572e63d74caf1810673981add47c9f328