Symptoms
Ideally state field on the incident record is audited by default and hence any state change on the incident record will be captured in sys_audit table, then the same would be populated in sys_history_line table, eventually it would be populated in activity stream on incident record.
All the state transition were captured in activity stream, but only a specific state transition was not captured.
Release
Any supported release.
Cause
The specific problematic state transition was performed by a update business rule. In that business rule script, setWorkflow(false) was used as shown in below screenshot hence particular state transition was not audited.
This is because, setWorkflow(false) disables processing of all engines and the update does not appear in the audit history of the task.
Resolution
Remove the setWorkflow(false) statement from the business rule script in which state being updated, so that state transition can be audited, eventually it will show up on activity stream.