# Baltique OS Core 2.1.0.1 — Administrator Route Access Repair

## Problem

`balt201_enforce_route_access()` used `balt_current_user(false)`. In Baltique OS this intentionally returns only the user id, not `role_slug`. Therefore an authenticated `admin` or `superadmin` was evaluated as `guest` before the upgrade page could execute.

## Repair

- loads the complete authenticated user record before route enforcement;
- adds an explicit administrator safety bypass;
- normalizes supported administrator aliases;
- keeps upgrade and technical routes unavailable to clinical roles;
- makes `/upgrade_2_1_0.php` apply this repair as well;
- provides `/upgrade_2_1_0_1.php`, which can idempotently install both base 2.1.0 and the repair.

No clinical rules, patient data, communication, documents, OR stages or automation settings are changed.