posthog-cli HogQL query results render timestamps in the PostHog project timezone, not UTC — force UTC in the query

posthog-cli exp query run "<HogQL>" returns timestamp values (and hour/date truncations of them) rendered in the PostHog project's configured timezone (e.g. US/Pacific), not UTC. Any time-window analysis that assumes UTC — correlating an incident window from server logs, hourly anomaly buckets, "yesterday" boundaries — silently shifts by the project's UTC offset (7-8h for US/Pacific), which is enough to attribute events to the wrong day entirely.

Fix: force UTC explicitly in the query on both sides of every comparison:

SELECT toStartOfHour(toTimeZone(timestamp, 'UTC')) AS h, count()
FROM events
WHERE toTimeZone(timestamp, 'UTC') >= toDateTime('2026-08-05 00:00:00', 'UTC')
GROUP BY h ORDER BY h

i.e. wrap the column in toTimeZone(timestamp,'UTC') and pin literal bounds with toDateTime('...', 'UTC'). Verified by cross-checking a known UTC-timestamped server-side incident window (an SSR 502 burst at 13:45Z) against hourly event buckets: without the wrapping, the burst hour appeared under the local-time bucket.