If a security guard only watches one shift at a time, what happens when a break-in is split across many?

This is about monitors that watch one run at a time and so miss attacks split across separate, non-overlapping runs. The corpus never uses the phrase "non-overlapping workloads", but it answers the underlying question. The problem is where the monitor draws its boundary. One note puts it plainly: Should defence units span multiple executions and agents? says that isolated review "loses relevant context that spans multiple executions." If the pieces of an intrusion run at different times, nothing in any single run's record shows they belong together.

The pieces also don't need to look suspicious, which makes it worse. Can stateless checks ever catch sequence-level constraint violations? shows that per-action checks structurally can't express a rule that depends on what came before. Individually permissible actions can add up to a system-level violation, and only a stateful monitor that tracks composed, multi-party behavior can catch that. The note makes this argument for single actions. The same logic applies one level up, where a per-execution monitor's memory ends when the run ends. Whatever links run A to run B, such as a handoff or a shared authority, sits outside its view.

The execution-scoped tools in the collection are good at what they do, which shows where the blind spot comes from. Can runtime instrumentation distinguish hacking exposure from actual exploitation? records authority-bearing transitions so it can tell a task that merely exposed a hacking vector from a run that actually used one. Can a finite lifecycle model detect reward hacking across benchmarks? checks a run against a finite lifecycle of typed events and flags deviation from the intended path. Each of them asks whether this run followed its intended path. Behavior spread across runs has no single run to deviate. Can scoped agents reliably judge semantic hacks in runtime analysis? makes the trade-off explicit: limiting the auditor's remit and fixing the artifacts it sees is what makes its verdicts checkable, and it also limits the auditor to what it was handed. These papers are about benchmark integrity, not intrusion, so applying them here is my reading and not something they claim.

The proposed fix changes what gets watched. The intrusion note suggests the unit of defence should be a coordination episode, a set of actions linked by observed transfers, task authority, and response history, with membership revised as evidence accumulates. That unit is defined by links and not by a shared clock or a run boundary, so whether the workloads overlap in time stops mattering. The corpus is thin on the practical side. It doesn't say how expensive it is to build those links, how often episodes get wrongly merged, or how common split-across-runs attacks are, so treat the idea as a well-argued design direction and not a proven result.