[docs] Update documentation for features from 2026-11-13

docs/src/content/docs/patterns/memory-ops.md

@@ -183,6 +183,10 @@ tools:
 
 Use a stable `memory-id`: runs update the state file at `/tmp/gh-aw/comment-memory/<memory-id>.md`, and changing the ID writes to a different file.
 
+The managed comment includes a collapsible **History** section linking to each workflow run that wrote the memory. Updates and clears preserve these links and deduplicate repeated run URLs, even when the generated footer is disabled. History stays outside the editable memory file.
+
+Older comments seed history from their most recent recorded attribution; earlier writers cannot be recovered. If the saved memory and accumulated history exceed the comment size limit, the update fails without changing the existing comment or dropping history. Reduce the saved memory size or use a new `memory-id`.
+
 ## Best Practices
 
 - Use JSON Lines for append-only logs and time-series data.

docs/src/content/docs/reference/triggers.md

@@ -147,6 +147,16 @@ on:
     types: [opened, edited, labeled]
 ```
 
+`types` also accepts `status_changed` for GitHub's preview issue-status activity:
+
+```yaml wrap
+on:
+  issues:
+    types: [status_changed]
+```
+
+Compilation accepts this activity type; event delivery depends on GitHub's availability of the preview.
+
 #### Issue Locking (`lock-for-agent:`)
 
 Prevent concurrent modifications to an issue during workflow execution by setting `lock-for-agent: true`:

docs/src/content/docs/troubleshooting/common-issues.md

@@ -252,6 +252,12 @@ If this fails, contact your organization administrator to enable Copilot for the
 > [!NOTE]
 > `COPILOT_GITHUB_TOKEN` must belong to a user account with an active Copilot subscription. Org-managed licenses may impose additional restrictions on programmatic API access.
 
+### GitHub Inference Cybersecurity Policy Rejections
+
+The provider error `422 This content was flagged for possible cybersecurity risk.` is a terminal policy rejection. For Copilot, Claude, and Codex using GitHub inference, the harness recognizes this prefix in supported top-level error events, classifies the failure as `content_filter`, and stops automatic retries. Quoted error text, unrelated HTTP 422 errors, and sub-agent errors do not trigger this classification.
+
+The run remains failed even if the agent previously emitted `noop`. Inspect the provider diagnostic with `gh aw audit <run-id>` and contact the organization administrator or provider support if access needs review.
+
 ## GitHub Enterprise Server Issues
 
 > [!IMPORTANT]
@@ -400,6 +406,8 @@ The failed workflow run is at https://github.com/OWNER/REPO/actions/runs/RUN_ID
 
 For manual investigation, use `gh aw audit <run-id>` and `gh aw logs`, then inspect the generated `.lock.yml`. See the [Debugging Workflows](/gh-aw/troubleshooting/debugging/) guide for a full walkthrough.
 
+If the failure annotation names `report_incomplete`, the agent reported that it could not complete the task. The conclusion can fail even when the agent job succeeded. Check the conclusion job summary for the reported reason, when available, and inspect `agent_output.json` in the `agent` artifact. The annotation omits agent-provided reasons and details; summaries can also be suppressed if secret redaction fails. Use `gh aw audit <run-id>` to compare the report with runtime evidence.
+
 ### Enable Debug Logging
 
 Use `--verbose`, set `ACTIONS_STEP_DEBUG = true`, or inspect MCP config with `gh aw mcp inspect`. The `DEBUG` environment variable enables internal logging for any `gh aw` command (to `stderr`, showing namespace, message, and elapsed time). Common namespaces: `cli:compile_command`, `workflow:compiler`, `workflow:expression_extraction`, `parser:frontmatter`; wildcards match any suffix.