In packages/db/src/services/event.service.ts around lines 512 to 514, the
duration expression can be NULL or negative (lead-based diff for session tail
and clock skew), so update the helper used by getDurationSql() to return SQL
that clamps negatives to zero and coalesces NULLs to 0 (e.g., wrap the computed
duration in GREATEST(..., 0) and COALESCE(..., 0) or equivalent for the SQL
dialect). Keep the call here unchanged — just harden the helper so
sb.select.duration receives a non-null, non-negative numeric duration.

In packages/db/src/services/overview.service.ts around lines 262 to 279, the
query is referencing any(ss.bounce_rate) but the bounce_stats CTE is never
joined and uses the wrong alias; fix by adding a LEFT JOIN bounce_stats bs ON
${startOfInterval} = bs.date (matching how session_stats is joined) and change
any(ss.bounce_rate) to any(bs.bounce_rate) so the bounce_rate column comes from
the correct CTE while keeping session_stats (ss) for avg_session_duration.

In packages/db/src/services/overview.service.ts around lines 526 to 543, the
current aggregates use plain avg/sum which miscounts when using
CollapsingMergeTree semantics; replace avg(duration * sign) / 1000 with
avgIf(duration, duration > 0 AND sign > 0) / 1000 (or round(avgIf(duration,
duration > 0 AND sign > 0) / 1000, 2)), replace round(sum(sign * is_bounce) *
100.0 / sum(sign), 2) with round(sumIf(is_bounce, duration > 0 AND sign > 0) *
100.0 / sumIf(sign, duration > 0 AND sign > 0), 2), and replace sum(sign) AS
sessions with sumIf(sign, duration > 0 AND sign > 0) AS sessions; keep same
GROUP BY, HAVING and ORDER clauses but ensure HAVING uses sumIf(sign, duration >
0 AND sign > 0) > 0.

In packages/db/src/services/profile.service.ts around lines 46 to 52, the
sessionDuration CTE’s WHERE clause is missing a filter on sign=1 which allows
collapsed/tombstone rows to skew duration stats; update the WHERE clause to
include AND sign = 1 (keeping existing escaped profileId and projectId) so
avg(duration) and quantilesExactInclusive(0.9)(duration) only consider
positive-sign sessions.

- .from(TABLE_NAMES.events)
- .where('project_id', '=', input.projectId)
- .where('path', '!=', '')
- .where('created_at', '>=', formatClickhouseDate(subMinutes(new Date(), 30)))
- .groupBy(['path', 'origin'])
+ .from(
+ clix.exp(`(
+ SELECT
+ origin,
+ path,
+ session_id,
+ ${getDurationSql()} AS duration
+ FROM ${TABLE_NAMES.events}
+ WHERE project_id = ${sqlstring.escape(input.projectId)}
+ AND path != ''
+ AND created_at >= '${formatClickhouseDate(subMinutes(new Date(), 30))}'
+ )`)
+ )
+ .groupBy(['path', 'origin'])
 .orderBy('count', 'DESC')
 .limit(100)
 .execute();

- .from(TABLE_NAMES.events)
- .where('project_id', '=', input.projectId)
- .where('referrer_name', 'IS NOT NULL')
- .where('created_at', '>=', formatClickhouseDate(subMinutes(new Date(), 30)))
- .groupBy(['referrer_name'])
+ .from(
+ clix.exp(`(
+ SELECT
+ referrer_name,
+ session_id,
+ ${getDurationSql()} AS duration
+ FROM ${TABLE_NAMES.events}
+ WHERE project_id = ${sqlstring.escape(input.projectId)}
+ AND referrer_name IS NOT NULL
+ AND created_at >= '${formatClickhouseDate(subMinutes(new Date(), 30))}'
+ )`)
+ )
+ .groupBy(['referrer_name'])
 .orderBy('count', 'DESC')
 .limit(100)
 .execute();

- .from(TABLE_NAMES.events)
- .where('project_id', '=', input.projectId)
- .where('created_at', '>=', formatClickhouseDate(subMinutes(new Date(), 30)))
- .groupBy(['country', 'city'])
+ .from(
+ clix.exp(`(
+ SELECT
+ country,
+ city,
+ session_id,
+ ${getDurationSql()} AS duration
+ FROM ${TABLE_NAMES.events}
+ WHERE project_id = ${sqlstring.escape(input.projectId)}
+ AND created_at >= '${formatClickhouseDate(subMinutes(new Date(), 30))}'
+ )`)
+ )
+ .groupBy(['country', 'city'])
 .orderBy('count', 'DESC')
 .limit(100)
 .execute();

#!/bin/bash
# Find getDurationSql implementation and check what it returns
rg -n "getDurationSql" --type=ts -B2 -A5 | head -50

#!/bin/bash
# View the actual code at the specified line ranges in realtime.ts
fd "realtime.ts" --type=f | xargs -I {} sh -c 'echo "=== File: {} ===" && sed -n "60,75p" {} && echo "" && sed -n "90,105p" {} && echo "" && sed -n "118,135p" {}'

#!/bin/bash
# Check what clix is and how exp() works - verify pattern used
rg -n "clix\.exp|from.*clix\.exp" --type=ts -B2 -A2 | head -30

ClickHouse window functions inside aggregate functions GROUP BY

---
🏁 Script executed:
```shell
#!/bin/bash
# Find the getDurationSql implementation in the db package
fd "event.service.ts" --type=f | xargs rg -n "export.*getDurationSql|function getDurationSql|const getDurationSql" -A10

#!/bin/bash
# Also search for any getDurationSql definition/export more broadly
rg -n "getDurationSql\s*=" --type=ts -A5 | head -40

#!/bin/bash
# Check the imports in realtime.ts to confirm the source
rg -n "from '@openpanel/db'" packages/trpc/src/routers/realtime.ts -A10 -B2

---
🏁 Script executed:
```shell
#!/bin/bash
# Check how sqlstring is used with project_id in codebase
rg -n "sqlstring.escape.*projectId|sqlstring.escape.*project_id" --type=ts -B2 -A2 | head -30

#!/bin/bash
# Check if paths/referrals/geo queries in realtime.ts filter by event name elsewhere
rg -n "name.*=|name.*IN" packages/trpc/src/routers/realtime.ts -B5 -A5 | grep -A5 -B5 "paths\|referrals\|coordinates"

#!/bin/bash
# Check overview.ts for similar queries to see if name filter is used
rg -n "\.where.*'name'" packages/trpc/src/routers/overview.ts -B3 -A3 | head -40

---
🏁 Script executed:
```shell
#!/bin/bash
# Check if clix.exp() is used in .from() anywhere in codebase
rg -n "\.from\s*\(" --type=ts -A1 packages/trpc/src/routers/ | grep -B1 "clix.exp\|exp\("

#!/bin/bash
# Check how clix handles subqueries or raw SQL in from clause
rg -n "clix.*\.from" --type=ts -B2 -A3 | head -50

#!/bin/bash
# Look for any existing examples of using raw SQL as a table/subquery with clix
rg -n "SELECT|from.*\(" packages/trpc/src/routers/realtime.ts -B1 -A1 | head -40

---
🏁 Script executed:
```shell
#!/bin/bash
# Find how the coordinates query (which uses raw SQL) is implemented
sed -n "22,35p" packages/trpc/src/routers/realtime.ts

#!/bin/bash
# Search for any clix subquery or CTE/WITH patterns
rg -n "WITH\s|CTE|subquery" packages/db/src/clickhouse/ --type=ts -B2 -A2 | head -40

#!/bin/bash
# Check clix query builder for .from() signature - look at type definitions or examples
rg -n "from.*\(.*\)" packages/db/src/clickhouse/query-builder.ts -B1 -A3 | head -60

---
🏁 Script executed:
```shell
#!/bin/bash
# Find clix.exp definition to confirm it returns Expression
rg -n "exp\s*\(" packages/db/src/clickhouse/ --type=ts -B1 -A3 | grep -B1 -A3 "export.*exp\|function exp"

#!/bin/bash
# Check if paths/referrals/geo are meant to track only screen_view events
# Look for any documentation or related queries that might filter by event type
rg -n "screen_view|session_start" packages/trpc/src/routers/realtime.ts -B3 -A3

#!/bin/bash
# Verify the Expression type and clix.exp usage pattern
rg -n "class Expression|interface Expression|export.*clix" packages/db/src/clickhouse/client.ts -A5 | head -30

In packages/trpc/src/routers/realtime.ts around lines 67-72 (and also update
analogous blocks at ~98 and ~128), the avg(round(... getDurationSql() ...)) call
is illegal because getDurationSql() returns a ClickHouse window function that
cannot be aggregated directly; rewrite each query to compute the windowed
duration in a subquery (select the window function as duration along with
origin/path/etc), then in the outer query perform COUNT(*) and
round(avg(duration)/1000,2) as avg_duration; keep using the codebase pattern of
clix Expression objects and sqlstring.escape for parameters when building the
subquery and outer query; also verify whether the paths/referrals/geo queries
should include the filter name = 'screen_view' like overview.ts and add that
filter inside the subquery if required.