Symptom: a previously-working HogQL query via posthog-cli started failing with validation_error (illegal_aggregation): Aggregate function sum(table.clicks) AS clicks is found inside another aggregate function in query (observed 2026-09-05, PostHog Cloud US).
Cause: aliasing an aggregate to the same name as the underlying column (sum(clicks) AS clicks) now shadows the column, so a later expression in the same SELECT like if(sum(impressions)>0, sum(clicks)/sum(impressions)*100, 0) resolves clicks to the aliased aggregate and reads as a nested aggregate.
Fix: rename the aliases so they don't collide with column names (e.g. sum(clicks) AS clicks_n, sum(spend) AS spend_usd) and reference columns, not aliases, inside other aggregates. ORDER BY should use the new alias.
Note: sum(clicks) AS clicks alone (no other aggregate referencing clicks) still works; the failure needs a second aggregate expression over the shadowed name. Audit saved/documented queries for this pattern; ours were embedded verbatim in an ops runbook and silently rotted.