Given a large user access log, parse it and identify which user_ids are returning customers—i.e., they have at least one visit on two or more distinct calendar days. Assume log lines contain an ISO 8601 timestamp, user_id, and URL; if the format is different, state your assumptions. Implement a solution in Python or SQL. Address: time‑zone normalization, deduping multiple hits on the same day, memory for large files (streaming vs batch), and complexity. Provide unit tests and example input/output.