diff --git a/python_ml/analytics_aggregator.py b/python_ml/analytics_aggregator.py
index d86c9ba..970f479 100644
--- a/python_ml/analytics_aggregator.py
+++ b/python_ml/analytics_aggregator.py
@@ -7,7 +7,7 @@ Mantiene dati permanenti per analytics long-term
 import psycopg2
 from psycopg2.extras import RealDictCursor
 import os
-from datetime import datetime, timedelta
+from datetime import datetime, timedelta, date
 import json
 from typing import Dict, List, Optional
 from collections import defaultdict
@@ -258,7 +258,7 @@ class AnalyticsAggregator:
             cursor.close()
             conn.close()
     
-    def aggregate_daily(self, target_date: Optional[datetime] = None):
+    def aggregate_daily(self, target_date: Optional[date] = None):
         """
         Aggrega statistiche giornaliere (somma delle ore)
         Se target_date è None, usa giorno precedente
diff --git a/replit.md b/replit.md
index a27ece0..316379f 100644
--- a/replit.md
+++ b/replit.md
@@ -50,6 +50,21 @@ The IDS employs a React-based frontend for real-time monitoring, detection visua
 
 ## Recent Updates (Novembre 2025)
 
+### 🔧 Analytics Aggregator Fix - Data Consistency (24 Nov 2025 - 17:00)
+- **BUG FIX CRITICO**: Risolto mismatch dati Dashboard Live
+- **Problema**: Distribuzione traffico mostrava 262k attacchi ma breakdown solo 19
+- **ROOT CAUSE**: Aggregatore contava **occorrenze** invece di **pacchetti** in `attacks_by_type` e `attacks_by_country`
+- **Soluzione**:
+  1. Spostato conteggio da loop detections → loop pacchetti  
+  2. `attacks_by_type[tipo] += packets` (non +1!)
+  3. `attacks_by_country[paese] += packets` (non +1!)
+  4. Fallback "unknown"/"Unknown" per dati mancanti (tipo/geo)
+  5. Logging validazione: verifica breakdown_total == attack_packets
+- **Invariante matematica**: `Σ(attacks_by_type) == Σ(attacks_by_country) == attack_packets`
+- **Files modificati**: `python_ml/analytics_aggregator.py`
+- **Deploy**: Restart ML backend + aggregator run manuale per testare
+- **Validazione**: Log mostra `match: True` e nessun warning mismatch
+
 ### 📊 Network Analytics & Dashboard System (24 Nov 2025 - 11:30)
 - **Feature Completa**: Sistema analytics con traffico normale + attacchi, visualizzazioni grafiche avanzate, dati permanenti
 - **Componenti**: