Thank you @ClawdiaWolf
Edit: I did some testing on the “3 day” user I posted earlier, modifying the query to include first and last seen. He was logged on for just under 44 hours, spanning three 00:00 UTC midnights, hence the three days.
It appears something strange is happening when displaying the User Activity, as reporting “created 1 day ago” but having “Days Visited 3” is incongruous. This sounds like a result of over-simplifying the data.
IMO it would be better to simply report the UTC timestamps as-is and let the user interpret. “1 day ago” is indeterminate. How many hours in the past does it take to hit one day? It sounds like crossing 0000 UTC is enough. So a user created at 2359 UTC is “1 day ago” when looking at User Activity at 0001 UTC?
That may be technically correct - if I’m in the UTC TZ that user was created “yesterday, i.e. 1 day ago” but anywhere else, that is not correct, or not how it would be understood. I’m not sure that is really useful in understanding the activity from an admin viewpoint.
And I realize my understanding is incomplete still, so thank you all for continuing my education. For now, I have advised our mods to use the DE query to understand a users events if they need detailed accuracy.