vmbox: single-stream pacman downloads, slirp stalls concurrent TCP

QEMU user-mode networking (libslirp 4.9.4 / qemu 11.1.1) freezes 2-4 of 5
concurrent 60 MB streams at ~10 MB until they time out, while one stream
does 45 MB/s. pacman's ParallelDownloads = 5 hit this on every guest
upgrade: a 90-package -Syu crawled at "500 KB/s" for minutes and then
finished in 12 s once set to 1. Window scaling and rmem do not help; a
tap/bridge NIC would but needs root, which vmbox avoids by design.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SS8M5wk88nJTXxDWz61KKk

vmbox/README.md

@@ -111,6 +111,14 @@ Two things that installer taught us, both worth knowing before you run it:
 - **No root anywhere.** User-mode networking with a per-VM forwarded SSH port;
   VM-to-VM traffic rides a socket multicast segment. No bridge, no libvirt, no
   daemon.
+- **User-mode networking stalls concurrent TCP streams.** Measured 2026-09-14
+  (libslirp 4.9.4, qemu 11.1.1): 5 parallel 60 MB downloads, 2–4 freeze at
+  ~10 MB and time out; one stream does 45 MB/s. The image therefore ships
+  `ParallelDownloads = 1` in pacman.conf — a 90-package `-Syu` that "ran at
+  500 KB/s" for minutes finished in 12 s single-stream. Guest-side TCP knobs
+  (window scaling, rmem) do not help; the real fix would be a tap/bridge NIC,
+  which needs root and is out of scope by design. Rebuild the base (`vm build`)
+  to pick this up; an already-built image lacks it.
 - **The guest clock is pinned** (`--rtc`) and re-applied on *every* launch. The
   shutdown installers gate on a 21:00–05:00 window, so an unpinned clock makes
   their tests pass or fail depending on the time of day. NTP is masked in the

vmbox/guest/provision.sh

@@ -37,6 +37,16 @@ else
     fi
 fi
 
+# QEMU user-mode networking (libslirp 4.9.4 / qemu 11.1.1, measured
+# 2026-09-14) stalls concurrent TCP streams: with 5 parallel 60 MB curls, 2-4
+# of them freeze at ~10 MB and time out while a single stream does 45 MB/s.
+# pacman's default ParallelDownloads = 5 hit it on every upgrade (a 90-package
+# -Syu sat at "500 KB/s" for minutes, then finished in 12 s single-stream).
+# Nothing guest-side fixes slirp (window scaling and rmem were tried); one
+# stream at a time is the whole fix.
+sed -i 's/^#*ParallelDownloads.*/ParallelDownloads = 1/' /etc/pacman.conf
+grep -q '^ParallelDownloads' /etc/pacman.conf || echo 'ParallelDownloads = 1' >> /etc/pacman.conf
+
 # The cloud image ships an empty package DB; -Syu also picks up any security
 # fixes since the image was cut.
 pacman -Syu --noconfirm --needed \