The .def files timestamp are calculated by stat command, but timestamps are refreshed only if $FWDIR/state/links.C file is updated. Since MDS was upgraded, but policy was not yet installed on the gateway, the links.C does not exist and therefore the .def timestamp were not refreshed.