Be careful, "ok" and "reached" are not the same. "ok" is only set for kept or repaired, but "reached" is always set. See https://github.com/Normation/ncf/blob/master/tree/20_cfe_basics/cfengine/common.cf#L213.