Causa del 403: Supabase evalúa siempre la política INSERT cuando se usa .upsert(), incluso si la fila ya existe. client_editor no tiene INSERT en processes, entonces cualquier .upsert() sobre procesos existentes fallaba con 403.

Fix: nuevo método updateEditable() en process-repo.ts que usa .update().eq('id', process.id) con solo los campos editables (sin bpmn_xml, owner_id, created_by, id). Todos los paths de edición en process-store.ts y library-store.ts ahora usan updateEditable(). El .upsert() original queda únicamente para la creación inicial desde ImportPage y setCurrentProcess — rutas que client_editor nunca puede alcanzar (el import está bloqueado por el guard de rol).

src/persistence/supabase/process-repo.ts

@@ -72,6 +72,28 @@ export const supabaseProcessRepo = {
     if (error) throw error
   },
 
+  // Actualiza solo campos editables por el usuario (sin bpmn_xml, owner_id, created_by).
+  // Usa UPDATE en lugar de upsert para evitar el chequeo de INSERT policy (que client_editor no tiene).
+  async updateEditable(process: Process, userId: string): Promise<void> {
+    const { error } = await supabase
+      .from('processes')
+      .update({
+        name: process.name,
+        client: process.clientName,
+        currency: process.currency,
+        overhead_percentage: process.overheadPercentage,
+        annual_frequency: process.annualFrequency,
+        analysis_horizon_years: process.analysisHorizonYears,
+        automation_investment: process.automationInvestment,
+        tags: process.tags,
+        group_id: process.groupId,
+        updated_by: userId,
+        updated_at: new Date().toISOString(),
+      })
+      .eq('id', process.id)
+    if (error) throw error
+  },
+
   async getById(id: string): Promise<Process | undefined> {
     const { data, error } = await supabase
       .from('processes')

src/store/library-store.ts

@@ -85,7 +85,7 @@ export const useLibraryStore = create<LibraryState>((set, get) => ({
     const process = get().processes.find((p) => p.id === processId)
     if (!process) return
     const updated = { ...process, groupId, updatedAt: Date.now() }
-    await supabaseProcessRepo.save(updated, userId)
+    await supabaseProcessRepo.updateEditable(updated, userId)
     set((state) => ({
       processes: state.processes.map((p) => p.id === processId ? updated : p),
     }))

src/store/process-store.ts

@@ -62,7 +62,7 @@ export const useProcessStore = create<ProcessState>((set, get) => ({
     const current = get().currentProcess
     if (!current) return
     const updated: Process = { ...current, ...updates, updatedAt: Date.now() }
-    await supabaseProcessRepo.save(updated, userId)
+    await supabaseProcessRepo.updateEditable(updated, userId)
     set({ currentProcess: updated })
   },
 
@@ -71,7 +71,7 @@ export const useProcessStore = create<ProcessState>((set, get) => ({
     const current = get().currentProcess
     if (current) {
       const updatedProcess = { ...current, updatedAt: Date.now() }
-      await supabaseProcessRepo.save(updatedProcess, userId)
+      await supabaseProcessRepo.updateEditable(updatedProcess, userId)
       set((state) => ({
         activities: state.activities.map((a) => (a.id === activity.id ? activity : a)),
         currentProcess: updatedProcess,
@@ -88,7 +88,7 @@ export const useProcessStore = create<ProcessState>((set, get) => ({
     const current = get().currentProcess
     if (current) {
       const updatedProcess = { ...current, updatedAt: Date.now() }
-      await supabaseProcessRepo.save(updatedProcess, userId)
+      await supabaseProcessRepo.updateEditable(updatedProcess, userId)
       set((state) => ({
         gateways: state.gateways.map((g) => (g.id === gateway.id ? gateway : g)),
         currentProcess: updatedProcess,
@@ -105,7 +105,7 @@ export const useProcessStore = create<ProcessState>((set, get) => ({
     const current = get().currentProcess
     if (current) {
       const updatedProcess = { ...current, updatedAt: Date.now() }
-      await supabaseProcessRepo.save(updatedProcess, userId)
+      await supabaseProcessRepo.updateEditable(updatedProcess, userId)
       set((state) => ({ resources: [...state.resources, resource], currentProcess: updatedProcess }))
     } else {
       set((state) => ({ resources: [...state.resources, resource] }))
@@ -117,7 +117,7 @@ export const useProcessStore = create<ProcessState>((set, get) => ({
     const current = get().currentProcess
     if (current) {
       const updatedProcess = { ...current, updatedAt: Date.now() }
-      await supabaseProcessRepo.save(updatedProcess, userId)
+      await supabaseProcessRepo.updateEditable(updatedProcess, userId)
       set((state) => ({
         resources: state.resources.map((r) => (r.id === resource.id ? resource : r)),
         currentProcess: updatedProcess,
@@ -134,7 +134,7 @@ export const useProcessStore = create<ProcessState>((set, get) => ({
     const current = get().currentProcess
     if (current) {
       const updatedProcess = { ...current, updatedAt: Date.now() }
-      await supabaseProcessRepo.save(updatedProcess, userId)
+      await supabaseProcessRepo.updateEditable(updatedProcess, userId)
       set((state) => ({
         resources: state.resources.filter((r) => r.id !== resourceId),
         currentProcess: updatedProcess,