Enter "windowed user-uptime"[1], which helps differentiate between these conditions.

[1] https://www.usenix.org/conference/nsdi20/presentation/hauer