safe_attributes 'status_id' uses the following if Proc to test :
issue.new_statuses_allowed_to(user).any?

The problem is, at this time issue is not already updated by the issue_attributes
Thus even if the update_form ajax proposed a new compatible status (without adding a flash message by the way), this status change is refused by safe_attributes.

In fact, I don't know why, but in the if Proc, issue already has the new tracker value, but with the old status, leading to new_statuses_allowed_to empty.

I have made a fix, to insert in the issues controller, but I suppose you will find something quite more elegant :¶

      if (
        issue_attributes.include?('tracker_id') &&
        issue_attributes.include?('status_id')
      )
        old_tracker_id = @issue.tracker_id
        old_status_id = @issue.status_id

        @issue.tracker_id = issue_attributes['tracker_id']
        @issue.status_id = issue_attributes['status_id']
        if (
          @issue.safe_attribute?('tracker_id') &&
          @issue.safe_attribute?('status_id')
        )
          issue_attributes.delete('tracker_id')
          issue_attributes.delete('status_id')
        else
          @issue.tracker_id = old_tracker_id
          @issue.status_id = old_status_id
        end
      end

      @issue.safe_attributes = issue_attributes