Every status change is checked against one rule map on the server.

Not hidden behind a disabled button — a crafted API request fails exactly the same way the UI does.