fix: store cross-midnight unattributed bytes once, not twice

The _add_unattributed_bytes function was adding the same cross-hour
delta to both days when the interval spanned midnight, violating the
spec requirement to preserve measured volume once as shared boundary
evidence.

Store the unattributed bytes only on the day where the interval starts
(the earlier day). This ensures the total across both days equals the
actual delta without duplication.

Closes #88 (cross-day delta duplication portion)

src/fenris/derive.py

@@ -217,25 +217,28 @@ def _add_unattributed_bytes(
     bw_delta: int,
     br_delta: int,
 ) -> None:
-    """Add unattributed byte deltas to day aggregates for each day touched."""
-    prev_day = prev_ts.strftime("%Y-%m-%d")
-    next_day = next_ts.strftime("%Y-%m-%d")
+    """Store unattributed byte deltas once as shared boundary evidence.
 
-    days = {prev_day, next_day}
-    for day in days:
-        existing = conn.execute(
-            "SELECT id FROM day_aggregates WHERE day = ?", (day,)
-        ).fetchone()
-        if existing is None:
-            conn.execute(
-                "INSERT INTO day_aggregates (day, unattributed_bytes_written, unattributed_bytes_read) "
-                "VALUES (?, ?, ?)",
-                (day, bw_delta, br_delta),
-            )
-        else:
-            conn.execute(
-                "UPDATE day_aggregates SET unattributed_bytes_written = unattributed_bytes_written + ?, "
-                "unattributed_bytes_read = unattributed_bytes_read + ? WHERE day = ?",
-                (bw_delta, br_delta, day),
-            )
+    A cross-midnight interval's delta is preserved on the day where it
+    STARTS (the earlier day).  It is not duplicated into both days;
+    the spec requires preserving the measured volume once as shared
+    unallocated boundary evidence (issue #88).
+    """
+    day = prev_ts.strftime("%Y-%m-%d")
+
+    existing = conn.execute(
+        "SELECT id FROM day_aggregates WHERE day = ?", (day,)
+    ).fetchone()
+    if existing is None:
+        conn.execute(
+            "INSERT INTO day_aggregates (day, unattributed_bytes_written, unattributed_bytes_read) "
+            "VALUES (?, ?, ?)",
+            (day, bw_delta, br_delta),
+        )
+    else:
+        conn.execute(
+            "UPDATE day_aggregates SET unattributed_bytes_written = unattributed_bytes_written + ?, "
+            "unattributed_bytes_read = unattributed_bytes_read + ? WHERE day = ?",
+            (bw_delta, br_delta, day),
+        )
     conn.commit()