diff --git a/docs/Disaggregated/notes/p7/device-window-2/tools/90-restore.sh b/docs/Disaggregated/notes/p7/device-window-2/tools/90-restore.sh
index af68edbd..6862acf3 100755
--- a/docs/Disaggregated/notes/p7/device-window-2/tools/90-restore.sh
+++ b/docs/Disaggregated/notes/p7/device-window-2/tools/90-restore.sh
@@ -20,23 +20,31 @@ w2_lock
 t0=$(date +%s)
 
 Ash "input keyevent KEYCODE_HOME"
+# A replay's app process stays cached after its Activity finishes, and a spawn replay's server
+# child (libMobileGLServer.so @mgl-<pid>-...) stays with it, holding its few hundred MB (seen after
+# the dry run). Stop the package first so nothing of the window outlives it, then bring the
+# supervisor back if it was up when the window opened.
+Ash "am force-stop $W2_PKG"
+sleep 1
 if [ "${FOUND_SUPERVISOR:-0}" = 1 ]; then
-    if w2_supervisor_running; then
-        log "supervisor already listening on $W2_LISTEN"
-    else
-        python3 "$W2_TOOLS/tools/trace_replay/tcp_device_server.py" start --serial "$W2_SERIAL" \
-            --package "$W2_PKG" --listen "$W2_LISTEN" --token "$W2_TOKEN" --allow-idle \
-            --state-file "$W2_IDLE_STATE" > "$OUT/supervisor-restart.txt" 2>&1
-        for _ in $(seq 1 20); do w2_supervisor_running && break; sleep 1; done
-        w2_supervisor_running && log "supervisor restarted on $W2_LISTEN" || log "WARN: supervisor NOT listening (see $OUT/supervisor-restart.txt)"
-    fi
+    python3 "$W2_TOOLS/tools/trace_replay/tcp_device_server.py" start --serial "$W2_SERIAL" \
+        --package "$W2_PKG" --listen "$W2_LISTEN" --token "$W2_TOKEN" --allow-idle \
+        --state-file "$W2_IDLE_STATE" > "$OUT/supervisor-restart.txt" 2>&1
+    for _ in $(seq 1 20); do w2_supervisor_running && break; sleep 1; done
+    w2_supervisor_running && log "supervisor restarted on $W2_LISTEN" || log "WARN: supervisor NOT listening (see $OUT/supervisor-restart.txt)"
     Ash "input keyevent KEYCODE_HOME"
 fi
 if [ -f "$OUT/pinned-by-window" ]; then
     bash "$W2_TOOLS/tools/device_bench/pin_device.sh" "$W2_SERIAL" unpin > "$OUT/pin-session-end.txt" 2>&1
     rm -f "$OUT/pinned-by-window"
 fi
-pin=$(w2_pin_check "$W2_TOOLS" "$OUT/pin-check-final.txt")
+# MIUI's launch boost clamps both CPU policies at max for a few seconds after the service start,
+# which `check` reads as DRIFT ("clamped by something other than this script"): re-read it.
+for _ in 1 2 3 4; do
+    pin=$(w2_pin_check "$W2_TOOLS" "$OUT/pin-check-final.txt")
+    [ "$pin" = "${FOUND_PIN:-UNPINNED}" ] && break
+    sleep 5
+done
 if [ -n "${FOUND_STAYON:-}" ] && [ "$(Ash 'settings get global stay_on_while_plugged_in')" != "$FOUND_STAYON" ]; then
     Ash "settings put global stay_on_while_plugged_in $FOUND_STAYON"
 fi
diff --git a/docs/Disaggregated/notes/p7/device-window-2/tools/RUNBOOK.md b/docs/Disaggregated/notes/p7/device-window-2/tools/RUNBOOK.md
index 2a9ed79e..54c2bc50 100644
--- a/docs/Disaggregated/notes/p7/device-window-2/tools/RUNBOOK.md
+++ b/docs/Disaggregated/notes/p7/device-window-2/tools/RUNBOOK.md
@@ -43,7 +43,7 @@ CTS 逐块写 `cts/runs/<block>/.done`。只重跑一例：删它的 `.done` 再
 | 5 | `40-bsl-stats.sh <stamp>` | bsl-esc-menu × {inproc, spawn} 各 1 遍，`MOBILEGL_PIPE_STATS=1 PERIOD=1`；先 force-stop 再起设备端 root 采样器（0.25 s：maps 行数、VmRSS、VmHWM；排除 argv 带 `tcp://` 的 supervisor server）；`wbuf[]` 从归档日志取 | ~1 min |
 | 6 | `50-cts-after.sh <stamp>` | APK 的 arm64 `libMobileGL.so` 推到 `mgcts` 并在设备上核 sha256；AFTER 环境 = `$BASE` 的 flag + `MOBILEGL_TRANSPORT=inproc` + `ROLE_SPLIT_STATE=1 STRICT_ERRORS=1 RUN_AHEAD=1`；臂证明（mgprobe PASS 且 logcat 有 inproc 解析句与 `Config: IPC … strict=1 role-split-state=1 run-ahead=1`、0 Fatal；再用一个 glcts 用例证一次）；五块依次跑（顺序同 `$BASE`），每块 `qpa_report --json`，最后 `cts_multi_report` 出与 `$BASE` 同形的 JSON | 6–7 min（pipe 头 lib inproc 实测 358 s；`$BASE` monolith 372 s） |
 | 7 | `60-reduce.py <stamp>` | 写 `verdict.txt` / `verdict.json`（见 §3） | <10 s |
-| 8 | `90-restore.sh <stamp>` | Home；supervisor 若开窗时在跑则以 `tcp_device_server.py start --allow-idle`（同 listen / token / Doze 状态文件）在**新 APK**上重启并核实在听；解钉频；stay-on 复原 | ~10 s |
+| 8 | `90-restore.sh <stamp>` | Home；`am force-stop` 包（回放后缓存的 app 进程与 spawn 回放留下的 `libMobileGLServer.so @mgl-…` 子进程会一直占着几百 MB）；supervisor 若开窗时在跑则以 `tcp_device_server.py start --allow-idle`（同 listen / token / Doze 状态文件）在**新 APK**上重启并核实在听；解钉频（MIUI 启动 boost 会让 `check` 短暂读成 DRIFT，重读至多 20 s）；stay-on 复原 | ~15 s |
 
 合计：构建 ~6 min + 设备 ~65–80 min ≈ **1.3–1.5 h**。外推依据见 §5。