it correctly showed that the config was recent, but didn't show the new directive. Running the agent solved the issue
Root cause analysis for latter reference: we need to ensure that when new expected reports are saved, then there is a compliance computation done for them. Here, we had both in parallele (the time taken to reach "new expect report available in base" was longer than the one to trigger and compute compliance, at least to reach the point where compliance get expected reports).
Since we now cache that info, the info was wrong until next compliance computation (that's was running agent on node solved the problem).