## System details

- Omarchy `4.0.2-1`
- Kernel `7.1.9-arch1-2` (stock Arch, **not** `linux-t2`)
- Apple `MacBookPro14,2` / `Mac-CAD6701F7CEA0921` (2017 13" Intel, **T1**, no T2 chip)
- GPU: Intel Kaby Lake Iris Plus 650 (`i915`)
- Two Intel JHL6540 Alpine Ridge Thunderbolt 3 controllers (`8086:15d2` NHI, `8086:15d3`/`8086:15d4` bridges/xHCI)
- `/sys/power/mem_sleep`: `s2idle [deep]` — S3 is selected and **does** work
- NVMe d3cold fix from `install/hardware/apple/fix-suspend-nvme.sh` is already installed (`0000:01:00.0/d3cold_allowed=0`)

This is **not** the T2 lid/sleep thread in https://github.com/omacom/omarchy/discussions/4695. `fix-t2.sh` correctly no-ops here (`lspci` has no `106b:180[12]`). `fix-suspend-nvme.sh` already matches `MacBookPro14,*` but does not cover Thunderbolt wakeup.

## What happened

1. Close the lid. Machine enters `PM: suspend entry (deep)`.
2. Alpine Ridge PME pulls it out of S3 about every 45s **with the lid still closed**. logind sees the closed lid and suspends again.
3. That loop ran for hours (lid close 12:03 → reboot 15:22). The chassis got hot; it was cool before the lid closed.
4. After enough cycles the thunderbolt resume path hung (`tb_cfg_read/write: -108`, `pcieport … Unable to change power state from D3cold to D0`, `not ready 1023ms after resume; giving up`). Opening the lid did nothing. Forced power-off.

Same boot also showed `omarchy-sleep-lock.service` restarting 160+ times, once per cycle.

## Expected

Lid closed → stay in S3, stay cool. Lid open → resume to the lock screen.

## Steps to reproduce

On `MacBookPro14,2` (likely `MacBookPro13,x` / `14,x` with Alpine Ridge as well):

1. `cat /proc/acpi/wakeup` — RP05, RP09, XHC2, XHC3 enabled for S3.
2. Close the lid and leave it closed.
3. `journalctl -b -1 | grep -E 'Lid |PM: suspend entry|Waking up'` — wake/suspend every ~45–50s with no `Lid opened`.
4. After many cycles, a lid-open requires a power-button hold.

## What worked here

Keep **deep** S3. Do not switch this model to s2idle; that is the heat path.

Gated on this generation (DMI `MacBookPro13,[123]|MacBookPro14,[123]` or PCI `8086:15d2`), next to the existing NVMe d3cold service:

1. **Disable ACPI/PCI wakeup** on the TB root ports and TB xHCI (`RP05`, `RP09`, `XHC2`, `XHC3`). Optionally `RP12` (Wi-Fi PME). Leave `LID0` and `SPIT` (Apple SPI keyboard/trackpad) enabled.
2. **`pcie_port_pm=off`** on the Limine cmdline (`/etc/limine-entry-tool.d/`). Alpine Ridge ports do not return from D3; each waits ~1s. With `pm_async=0` those waits run in series (~1 minute of black screen). Even with `pm_async=1`, ACPI resume still costs ~5s until this is set. *Needs a reboot; not yet re-tested on this box.*
3. Unload/`blacklist thunderbolt` stopped the `tb_cfg_*` WARN flood. USB-C charging still worked. **Do not land a blanket blacklist** without a discussion — TB docks / DP-alt would break. Wakeup disable + `pcie_port_pm=off` is the conservative first patch.

## What did **not** work (please do not copy)

- `pm_async=0` — correct for some T2 PRs, **wrong** here; serialized TB timeouts into a ~60s resume.
- Unbinding Thunderbolt NHIs in a systemd-sleep hook — did not prevent the hang, and a live `pci rescan` blocked in the kernel.
- Relying on logind `HandleLidSwitch=suspend` — see 12193; a 2s close/open slept with the lid already open and never woke.

## Suggested shape

Extend `install/hardware/apple/fix-suspend-nvme.sh` (or a sibling `fix-suspend-alpine-ridge.sh` called from `install/hardware/all.sh`) plus a migration:

- oneshot that disables the TB ACPI wakeup nodes (toggle `/proc/acpi/wakeup` only when currently enabled)
- udev rules: `8086:15d2` / `8086:15d4` `power/wakeup=disabled`
- Limine drop-in: `pcie_port_pm=off`
- leave `thunderbolt` loaded unless a later change proves a blacklist is required