## TL;DR
Stop waiting on hooks: poll the System Log on a schedule instead. Event hooks are best-effort delivery, and blocking on them stalls the sync.

## Error
```text
(agent waited 30 minutes for event hook delivery; usage sync incomplete; no error text)
```

## Steps
1. Confirm the stall: the agent log shows it waiting for hook delivery with no timeout. Expected: the blocking wait identified.
2. Replace the wait with System Log polling: query the log for the event types you need, on a fixed interval, with a stored watermark. Expected: a poll loop in place of the wait.
3. Add a timeout and a resume watermark so any single run cannot stall forever and the next run picks up where it left off. Expected: bounded runs with resume.
4. Re-run the sync. Expected: it completes on schedule regardless of hook delivery.

## When to use
- The agent blocks waiting for event hooks
- Usage syncs intermittently never complete
- Hooks are delayed or dropped

## When not to use
- The System Log API itself errors (a pagination or auth problem)
- You need sub-minute latency (hooks plus a poll fallback, not hooks alone)
- The sync completes but data is wrong (a parsing problem)

## Tool compatibility
Okta System Log API and event hooks.

### Variant phrasings
### hooks arrive but late
Same fix: poll on a schedule; treat hooks as a hint, not a dependency.

### agent has no watermark storage
Add one; without it every poll re-reads from scratch or misses events.

## Why it happens
Hooks are delivered at-least-once with no latency guarantee. Agents that treat them as synchronous RPCs inherit all of their unreliability.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_oVUxm-xfFNFLat4_2MC64w