From afb8266407e9dca0b61a27edd25e62277be67aa7 Mon Sep 17 00:00:00 2001
From: Marius <marius@example.com>
Date: Tue, 25 Aug 2026 15:46:28 +0300
Subject: [PATCH] feat(oracle): granturi dictionar PACK_DIAG_SPATIU +
 sys-grants.sql legat in flux

Trei probleme gasite pregatind migrarea unui client de pe Oracle XE 11 pe XE 21c.

1. sys-grants.sql nu era rulat de niciun script PowerShell. Era referit doar din
   run-all-sys.sql, care se lanseaza manual. Pe orice instalare facuta cu
   RunAll.cmd lipseau sinonimele SYS (SYN_NEWSCHEMA, SYN_NEWSCHEMAJOB,
   EXECUTESCRIPTOS, SYN_PINFO), DMPDIR si granturile pe DBMS_SCHEDULER / UTL_* /
   DBMS_CRYPTO catre CONTAFIN_ORACLE. Legat ca STEP 3 in 04-create-synonyms-grants,
   dupa import - unde propriul header al fisierului spune ca trebuie rulat.

2. Granturile de dictionar cerute de PACK_DIAG_SPATIU lipseau complet. Consolidez
   sys_2026_08_03_05, sys_2026_08_03_07 si sys_2026_08_06_07 in sectiunea [5/5]
   din sys-grants.sql: SELECT direct pe 18 vederi dba_*/v$*, idempotent, cu
   ORA-00942 tratat pentru vederile absente pe alte editii/versiuni. Grantul prin
   rolul DBA nu ajunge - rolurile nu se aplica in pachetele cu drepturi de
   definitor, iar PACK_DIAG_SPATIU e exact asa; fara ele ramane INVALID si
   DIAGSPATIU_ZILNIC nu ruleaza.

3. Capcana la migrari: tabela de versiuni a lui PACK_MIGRARE traieste in
   CONTAFIN_ORACLE si vine cu DMP-ul, deci baza noua raporteaza scripturile sys_*
   drept aplicate si ROAACTUALIZARI le sare, desi in SYS nu exista nimic. De aceea
   obiectele si granturile SYS se pun la instalare, nu prin actualizator.
   Documentat in sys-updates/README.md si in ghidul nou.

07-verify-installation raporteaza nominal care dintre cele 18 granturi lipsesc.

Documentatie: docs/instalare-si-migrare-oracle.md - arbore de decizie intre
roa-windows-setup/ (client pe Windows), migration/ (Oracle in Docker pe LXC 108) si
new-roa-oracle-server/ (arhiva). Include de ce migration/ nu se foloseste la un
client Windows: creeaza PDB ROA cu OraclePass123, sinonime minimale, fara
SERVER_INFO / ROAUPDATE / ACL / sqlnet.ora, iar sys_objects.sql de acolo creeaza
INFO in SYSTEM - cauza cunoscuta a ORA-01653 la actualizare. Plus comenzile de
export din XE 11 / 10g si plafonul XE de 12 GB.

Corectat pe drum: dual-edition-test-plan si issues-se-prod indicau clonarea
VM 302 -> 303 pentru testul SE, dar 303 e ocupat de Win11-Adina. Mutat pe 304.

NETESTAT pe baza reala - VM 302 e oprit. Scripturile trec doar parse-check
PowerShell.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SzF1hf4aFS1tmJWpPMiwGp
---
 CLAUDE.md                                     |    1 +
 proxmox/README.md                             |    2 +
 proxmox/lxc108-oracle/README.md               |    5 +
 .../docs/instalare-si-migrare-oracle.md       |  218 ++++
 proxmox/lxc108-oracle/migration/README.md     |   14 +
 .../lxc108-oracle/roa-windows-setup/README.md |   90 +-
 .../scripts/04-create-synonyms-grants.ps1     |  507 ++++----
 .../scripts/07-verify-installation.ps1        | 1081 +++++++++--------
 .../roa-windows-setup/sql/sys-grants.sql      |   74 +-
 .../sql/sys-updates/README.md                 |   13 +-
 proxmox/vm302-oracle-test/README.md           |    5 +
 .../docs/dual-edition-test-plan.md            |   12 +-
 .../vm302-oracle-test/docs/issues-se-prod.md  |    2 +-
 13 files changed, 1267 insertions(+), 757 deletions(-)
 create mode 100644 proxmox/lxc108-oracle/docs/instalare-si-migrare-oracle.md

diff --git a/CLAUDE.md b/CLAUDE.md
index bed27d6..0b1acc4 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -45,6 +45,7 @@ input/                      # Oracle DMP files for import
 - **Chatbot architecture**: `proxmox/lxc104-flowise/docs/prd.md`
 - **Docker Sandboxes (sbx) — agenți AI izolați**: `proxmox/lxc102-docker/README.md`
 - **Disaster recovery**: `proxmox/vm109-windows-dr/README.md`
+- **Instalare/migrare Oracle — care director se folosește**: `proxmox/lxc108-oracle/docs/instalare-si-migrare-oracle.md`
 - **ROA Windows setup scripts (XE/SE 21c)**: `proxmox/lxc108-oracle/roa-windows-setup/README.md`
 - **VM 302 test environment for ROA setup**: `proxmox/vm302-oracle-test/README.md`
 - **Diagnostic spațiu Oracle la clienți (job zilnic + emailuri)**: `docs/diagnostic-spatiu-clienti.md`
diff --git a/proxmox/README.md b/proxmox/README.md
index 8e102c0..a4ebdbf 100644
--- a/proxmox/README.md
+++ b/proxmox/README.md
@@ -49,6 +49,7 @@ proxmox/
 │   ├── clienti/                       # Cazuri concrete clienți (depanare/recreare DB)
 │   │   ├── README.md                  # Index cazuri
 │   │   └── oracle-xe-21c/             # ROMPETROL ENERGY: recreare PDB după ORA-12954
+│   ├── docs/                          # Ghid rutare instalare vs. migrare Oracle
 │   ├── roa-windows-setup/             # Scripturi setup ROA pe Windows + Oracle 21c
 │   └── sql/
 │       ├── roa/                       # SQL-uri Oracle 10g compatibilitate
@@ -482,6 +483,7 @@ ssh root@10.0.20.201 "qm snapshot 302 pre-test --description 'Before ROA test'"
 - **Plan testare dual-edition** → `vm302-oracle-test/docs/dual-edition-test-plan.md`
 - **Erori prod Oracle SE (TODO)** → `vm302-oracle-test/docs/issues-se-prod.md`
 - **Scripturi setup ROA Windows** → `lxc108-oracle/roa-windows-setup/`
+- **Care director de instalare/migrare Oracle se folosește** → `lxc108-oracle/docs/instalare-si-migrare-oracle.md`
 
 ### Windows VM 201
 - **Reînnoiesc certificate SSL** → `vm201-windows/docs/vm201-certificat-letsencrypt-iis.md`
diff --git a/proxmox/lxc108-oracle/README.md b/proxmox/lxc108-oracle/README.md
index a09d33c..850103c 100644
--- a/proxmox/lxc108-oracle/README.md
+++ b/proxmox/lxc108-oracle/README.md
@@ -1,5 +1,10 @@
 # Oracle Database XE - LXC 108 (Proxmox)
 
+> **Scripturi de instalare / migrare Oracle pentru ROA** — trei directoare, ghid de rutare
+> în [`docs/instalare-si-migrare-oracle.md`](docs/instalare-si-migrare-oracle.md):
+> `roa-windows-setup/` (client pe Windows), `migration/` (Oracle în Docker pe acest LXC),
+> `new-roa-oracle-server/` (arhivă istorică, nu se rulează).
+
 ## 📌 Informații Container LXC
 
 - **VMID:** 108
diff --git a/proxmox/lxc108-oracle/docs/instalare-si-migrare-oracle.md b/proxmox/lxc108-oracle/docs/instalare-si-migrare-oracle.md
new file mode 100644
index 0000000..52f16f0
--- /dev/null
+++ b/proxmox/lxc108-oracle/docs/instalare-si-migrare-oracle.md
@@ -0,0 +1,218 @@
+# Instalare și migrare Oracle pentru ROA — care director, pentru ce
+
+În `proxmox/lxc108-oracle/` există **trei** directoare cu scripturi de instalare/migrare, iar
+numele lor nu spun de la sine care se potrivește. Nota asta e ghidul de rutare: ce livrează
+fiecare, ce **nu** livrează și cum se aleg între ele.
+
+| Director | Ce e | Stare |
+|---|---|---|
+| [`roa-windows-setup/`](../roa-windows-setup/README.md) | instalare ROA completă pe **Windows** + Oracle 21c (XE sau SE) | activ, validat pe VM 302 (XE) |
+| [`migration/`](../migration/README.md) | migrare Oracle 10g → 21c XE cu Oracle **în Docker pe LXC 108** | activ pentru infrastructura internă |
+| [`new-roa-oracle-server/`](../new-roa-oracle-server/) | arhiva istorică din era Oracle 10g | **doar referință**, nu se rulează |
+
+---
+
+## 1. Arbore de decizie
+
+```
+Baza Oracle ajunge pe un server Windows la client?
+├── DA  → roa-windows-setup/          (PowerShell nativ, fără WSL)
+└── NU  → baza ajunge în Docker pe LXC 108 / alt Linux?
+          ├── DA  → migration/         (bash, orchestrat de 00-MASTER-MIGRATION.sh)
+          └── NU  → niciunul; descrie scenariul înainte de a improviza
+```
+
+**Cazul tipic la client** — server vechi cu Oracle XE 11 (sau 10g), se mută
+`CONTAFIN_ORACLE` + schemele de firme pe un server nou cu Oracle 21c XE, tot Windows:
+→ **`roa-windows-setup/`**, plus pasul de export descris la §4.
+
+---
+
+## 2. Ce livrează fiecare
+
+### `roa-windows-setup/` — instalare ROA, nu doar bază de date
+
+Diferența esențială: `migration/` îți lasă o bază cu schemele înăuntru;
+`roa-windows-setup/` îți lasă o **instalare ROA funcțională**.
+
+| # | Script | Ce face |
+|---|---|---|
+| 01 | `01-setup-database.ps1` | tablespace `ROA`, profil, user `CONTAFIN_ORACLE`, `sqlnet.ora` cu `ALLOWED_LOGON_VERSION=8` |
+| 02 | `02-create-sys-objects.ps1` | obiectele SYS din `sql/sys-objects.sql` (AUTH_PACK, AUTH_DETALII, AUTH_SERII, VAUTH_SERII, INFO, pINFO, SEQ_AUTH_SERII, EXECUTESCRIPTOS, NEWSCHEMA, NEWSCHEMAJOB, UPDATESQLPLUS) |
+| 03 | `03-import-contafin.ps1` | import `CONTAFIN_ORACLE` (parfile: `par/import-contafin.par`) |
+| 04 | `04-create-synonyms-grants.ps1` | `synonyms-public.sql` + `grants-public.sql` + **`sys-grants.sql`** (granturi SYS, sinonime SYS, DMPDIR, granturi de dicționar pentru `PACK_DIAG_SPATIU`), context `SESIUNE`, ACL de rețea |
+| 05 | `05-import-companies.ps1` | import în lot al schemelor de firme (parfile: `par/import-company.par`) |
+| 06 | `06-add-company.ps1` | adaugă o firmă nouă pe un server deja instalat (opțional) |
+| 08 | `08-post-install-config.ps1` | 54 directoare `ROAUPDATE` (fizice + obiecte `DIRECTORY`), `SERVER_INFO`, `AUTH_DETALII` (Customer ID), joburile `UPDATEROA_ZILNIC` / `UPDATERTVAI_ZILNIC` / `SYSINFO_PURJARE_ZILNIC` |
+| 07 | `07-verify-installation.ps1` | raport de verificare: versiune/ediție, tablespace, obiecte, obiecte invalide, sinonime, **granturi de dicționar**, firme din `NOM_FIRME` vs. scheme reale, ACL |
+| 99 | `99-uninstall-roa.ps1` | curățare completă, pentru re-testare |
+
+`RunAll.cmd` le rulează în ordinea `01 → 02 → 03 → 04 → 05 → 08 → 07`.
+`Run.cmd <script>` rulează unul singur, rezolvând `ExecutionPolicy`.
+
+Compatibilitate cu clienți vechi: `01-setup-database.ps1` scrie
+`SQLNET.ALLOWED_LOGON_VERSION_SERVER/CLIENT=8` (implicitul în 21c este 12 și **refuză**
+Instant Client 10/11). Detalii și capcanele — în
+[`config/sqlnet.ora`](../roa-windows-setup/config/sqlnet.ora): fișierul merge în *Oracle Base
+Home*, nu în `ORACLE_HOME`; listener-ul se **oprește și pornește** (nu doar `reload`); parolele
+trebuie resetate ca să se regenereze verificatorul 10G.
+
+### `migration/` — Oracle în Docker pe LXC 108
+
+| Script | Ce face |
+|---|---|
+| `00-MASTER-MIGRATION.sh` | orchestratorul; moduri de export AUTO (SSH) / MANUAL / LOCAL / IN-PLACE |
+| `00-MASTER-MIGRATION.bat` | varianta Windows; pentru scenariile 1-3 deleagă la `wsl bash -c ./00-MASTER-MIGRATION.sh`, iar pe ramura nativă își **generează la runtime** `setup-windows.sql`, `synonyms-windows.sql`, `finalize-windows.sql` |
+| `00-install-oracle21c-xe.sh` | instalează Oracle 21c XE **în Docker** |
+| `01-setup-oracle21c.sh` … `06-finalize-migration.sh` | tablespace + useri, export, transfer DMP, import, sinonime/granturi, recompilare |
+| `sys_objects.sql` | obiectele SYS, **versiunea pre-consolidare** |
+
+De ce nu se folosește la un client Windows, deși are și un `.bat`:
+
+- ramura nativă creează un **PDB numit `ROA`** în CDB-ul XE, cu parola `OraclePass123` — altă
+  convenție decât `XEPDB1` / `romfastsoft` din `roa-windows-setup`;
+- generează un set minimal de sinonime, nu cele 81 publice și nici cele 54 de `DIRECTORY`;
+- nu configurează `SERVER_INFO`, `AUTH_DETALII`, joburile de actualizare, ACL-ul de rețea;
+- nu scrie `sqlnet.ora` de compatibilitate — aplicațiile vechi ale clientului nu se vor conecta;
+- `sys_objects.sql` de acolo creează `AUTH_DETALII`, `AUTH_SERII` **și `INFO` în `SYSTEM`** —
+  exact cauza umplerii tablespace-ului dicționarului și a erorilor `ORA-01653` la actualizare
+  (vezi [`docs/diagnostic-spatiu-clienti.md`](../../../docs/diagnostic-spatiu-clienti.md)). În
+  `roa-windows-setup/sql/sys-objects.sql` asta e deja corectat: `INFO` se creează în
+  tablespace-ul `ROA`.
+
+### `new-roa-oracle-server/` — arhivă
+
+Conține `createdb.sql`, `createco.sql`, `createfn.sql`, `roa.bat`, `roa_firma.bat` și seria
+istorică `sys_2007_*` … `sys_2026_01_*`. E **sursa din care a fost consolidat**
+`roa-windows-setup/sql/sys-objects.sql`, nu un runbook. Nu se rulează pe un server nou.
+
+---
+
+## 3. Ce **nu** e acoperit de scripturi
+
+Exportul de pe serverul sursă nu e automatizat în `roa-windows-setup/`. Fișierele DMP se
+așteaptă deja în `C:\DMPDIR\` pe serverul nou.
+
+---
+
+## 4. Export de pe un server client existent (XE 11 / 10g)
+
+**Oracle XE 11.2 → 21c.** `impdp` din 21c acceptă direct seturile Data Pump produse de 11.2,
+deci nu e nevoie de `VERSION=`:
+
+```bat
+REM pe serverul sursa, ca SYSTEM
+sqlplus system/parola@XE
+  CREATE OR REPLACE DIRECTORY DMPDIR AS 'C:\DMPDIR';
+  GRANT READ, WRITE ON DIRECTORY DMPDIR TO SYSTEM;
+
+expdp system/parola@XE SCHEMAS=CONTAFIN_ORACLE DIRECTORY=DMPDIR ^
+      DUMPFILE=contafin_oracle.dmp LOGFILE=export_contafin.log
+
+expdp system/parola@XE SCHEMAS=FIRMA1,FIRMA2 DIRECTORY=DMPDIR ^
+      DUMPFILE=firme_%U.dmp LOGFILE=export_firme.log PARALLEL=2
+REM  ^ %U e substituția Data Pump; din interiorul unui fișier .bat se scrie %%U
+```
+
+Lista schemelor de exportat se ia din `CONTAFIN_ORACLE.NOM_FIRME` (`WHERE sters = 0`) — e
+aceeași listă pe care `07-verify-installation.ps1` o compară apoi cu schemele existente pe
+serverul nou.
+
+**Oracle 10g ca sursă.** `expdp` există de la 10.1, dar dacă exportul a fost făcut cu `exp`
+clasic, importul se face cu `imp`, nu cu `impdp` — cele două formate nu sunt interschimbabile.
+
+**Export din LXC 108 (mediul intern), pentru clienți care cer compatibilitate 11g:**
+
+```bash
+docker exec oracle18-xe expdp system/romfastsoft@localhost:1521/XEPDB1 \
+  SCHEMAS=CONTAFIN_ORACLE DIRECTORY=DMPDIR DUMPFILE=contafin_oracle.dmp \
+  LOGFILE=export_contafin.log VERSION=11.2
+```
+
+Containerul 18c (port 1522) există tocmai pentru asta — 21c nu poate produce dump-uri cu
+`VERSION=11.2` din cauza tipurilor TSTZ versiunea 31.
+
+---
+
+## 5. Scripturile `sys_*` — proveniență și sincronizare
+
+Scripturile `sys_*` produc obiecte **deținute de SYS**, deci **nu călătoresc în DMP-ul de
+schemă**. Pe un server nou trebuie aplicate explicit, prin `02-create-sys-objects.ps1` și
+`04-create-synonyms-grants.ps1`.
+
+### Capcana tabelei de versiuni
+
+Tabela de versiuni a lui `PACK_MIGRARE` trăiește în **`CONTAFIN_ORACLE`** — acolo își
+înregistrează și scripturile `sys_*` aplicarea (`pack_migrare.UpdateVersiune(..., 'SYS')`).
+Tabela vine cu DMP-ul.
+
+Consecința, la migrarea unui client existent: baza nouă raportează scripturile `sys_*` drept
+**deja aplicate**, `ROAACTUALIZARI` le sare, dar în `SYS` nu există nimic. De aceea obiectele
+și granturile SYS se pun la instalare, din scripturile de setup — nu se așteaptă de la
+actualizator.
+
+### Stare curentă a sincronizării
+
+Sursa scripturilor `sys_*` e `D:\roa\database\SCRIPTURI_CLAR\<an>\<luna>\`.
+
+| Script sursă | Unde e în `roa-windows-setup/` |
+|---|---|
+| `sys_2026_01_14_01_AUTH_PACK` | `sql/sys-objects.sql` — specificația e identică, iar lista de programe din repo e un superset (`GENERARESCRIPT.EXE`, `ROAACTUALIZARI.EXE`, `EXP.EXE`, `IMP.EXE` în plus) |
+| `sys_2026_08_08_02_SYS_INFO_TABLESPACE_PURJARE` | `sql/sys-objects.sql` (INFO creată în tablespace-ul `ROA`) + `sql/scheduler-jobs.sql` (`SYS.SYSINFO_PURJARE_ZILNIC`) |
+| `sys_2026_08_03_05_DIAG_SPATIU_GRANT` | `sql/sys-grants.sql`, secțiunea `[5/5]` |
+| `sys_2026_08_03_07_DIAG_SPATIU_GRANT2` | `sql/sys-grants.sql`, secțiunea `[5/5]` |
+| `sys_2026_08_06_07_DIAG_SPATIU_GRANT3` | `sql/sys-grants.sql`, secțiunea `[5/5]` |
+
+Cele trei scripturi `DIAG_SPATIU_GRANT*` acordă `SELECT` direct pe 18 vederi de dicționar:
+`DBA_DATA_FILES`, `DBA_FREE_SPACE`, `DBA_TEMP_FILES`, `DBA_SEGMENTS`, `DBA_TAB_STATS_HISTORY`,
+`DBA_SCHEDULER_JOB_RUN_DETAILS`, `DBA_RECYCLEBIN`, `DBA_TABLESPACES`, `DBA_LOBS`,
+`DBA_LOB_PARTITIONS`, `DBA_INDEXES`, `V_$INSTANCE`, `V_$DATABASE`, `V_$PARAMETER`,
+`V_$TRANSACTION`, `V_$TEMP_SPACE_HEADER`, `V_$FLASH_RECOVERY_AREA_USAGE`, `V_$VERSION`.
+
+Grantul trebuie să fie **direct**, nu prin rolul `DBA`: rolurile nu se aplică în pachetele cu
+drepturi de definitor, iar `CONTAFIN_ORACLE.PACK_DIAG_SPATIU` este exact așa. Fără ele
+pachetul rămâne `INVALID` și jobul `DIAGSPATIU_ZILNIC` nu rulează. Vederile absente pe o
+ediție/versiune dată sunt sărite (`ORA-00942`), deci scriptul e sigur și pe baze mai vechi.
+
+`07-verify-installation.ps1` are o secțiune dedicată care listează care dintre cele 18 lipsesc.
+
+### Când apar scripturi `sys_*` noi
+
+Un `sys_*` nou fie se **consolidează** în `sys-objects.sql` / `sys-grants.sql` /
+`scheduler-jobs.sql` (dacă e parte din instalarea de bază), fie se pune în `sql/sys-updates/`
+ca patch post-instalare. Vezi
+[`sql/sys-updates/README.md`](../roa-windows-setup/sql/sys-updates/README.md).
+
+---
+
+## 6. Mediu de test
+
+Validarea se face pe **VM 302 (`oracle-test-302`, 10.0.20.130)** — vezi
+[`../../vm302-oracle-test/README.md`](../../vm302-oracle-test/README.md).
+
+| Ediție | Stare |
+|---|---|
+| 21c XE (CDB/PDB) | OK — `RunAll.cmd` rulează complet |
+| 21c SE (non-CDB) | **NETESTAT** — în producție au apărut erori, vezi [`issues-se-prod.md`](../../vm302-oracle-test/docs/issues-se-prod.md) |
+
+VM 302 stă oprit; se pornește cu `ssh root@10.0.20.201 "qm start 302"`.
+Ciclul de re-testare: `99-uninstall-roa.ps1 -Force` → `RunAll.cmd` → `07-verify-installation.ps1`.
+
+Scripturile din `migration/` **nu** au un mediu de test dedicat — se validează direct pe
+LXC 108.
+
+---
+
+## 7. De verificat înainte de a porni o migrare la client
+
+- **Plafonul XE.** 21c XE limitează datele de utilizator la **12 GB** (11.2 XE avea 11 GB),
+  RAM la 2 GB și 2 thread-uri CPU. Se măsoară pe sursă înainte:
+  ```sql
+  SELECT ROUND(SUM(bytes)/1024/1024/1024, 2) AS gb
+    FROM dba_segments
+   WHERE owner NOT IN ('SYS','SYSTEM','OUTLN','DBSNMP','XDB','APEX_040000');
+  ```
+  Peste plafon, singura opțiune e Standard Edition — care e **netestată** (vezi §6).
+- **CDB/PDB.** Pe XE 21c aplicațiile se conectează la **`XEPDB1`**, niciodată la `XE` (CDB root).
+- **Clienți vechi.** `sqlnet.ora` + resetarea parolelor, altfel Instant Client 10/11 nu se conectează.
+- **Versiunea sursei.** `expdp` (Data Pump) și `exp` (clasic) produc formate incompatibile.
diff --git a/proxmox/lxc108-oracle/migration/README.md b/proxmox/lxc108-oracle/migration/README.md
index 1cd23cb..70c357a 100644
--- a/proxmox/lxc108-oracle/migration/README.md
+++ b/proxmox/lxc108-oracle/migration/README.md
@@ -1,5 +1,19 @@
 # 🚀 SCRIPTURI AUTOMATIZARE MIGRARE ORACLE 10g → 21c XE
 
+> ## ⚠️ Nu acesta e directorul pentru un client pe Windows
+>
+> Scripturile de aici țintesc **Oracle 21c XE în Docker pe LXC 108** (sau alt Linux).
+> Ramura `.bat` creează un PDB `ROA` cu parola `OraclePass123`, generează un set minimal
+> de sinonime și **nu** configurează `SERVER_INFO`, directoarele `ROAUPDATE`, joburile de
+> actualizare, ACL-ul de rețea sau `sqlnet.ora` de compatibilitate pentru Instant Client
+> 10/11. În plus, `sys_objects.sql` de aici creează `AUTH_DETALII`, `AUTH_SERII` și `INFO`
+> **în `SYSTEM`** — cauza cunoscută a erorilor `ORA-01653` la actualizare.
+>
+> Pentru **instalare/migrare ROA pe un server Windows la client** folosește
+> [`../roa-windows-setup/`](../roa-windows-setup/README.md).
+> Comparația completă și arborele de decizie:
+> [`../docs/instalare-si-migrare-oracle.md`](../docs/instalare-si-migrare-oracle.md).
+
 **Director:** `proxmox/lxc108-oracle/migration/`
 **Data**: 1 Octombrie 2025
 **Status**: ✅ TESTAT ȘI FUNCȚIONAL
diff --git a/proxmox/lxc108-oracle/roa-windows-setup/README.md b/proxmox/lxc108-oracle/roa-windows-setup/README.md
index 56a8694..e54f45d 100644
--- a/proxmox/lxc108-oracle/roa-windows-setup/README.md
+++ b/proxmox/lxc108-oracle/roa-windows-setup/README.md
@@ -1,5 +1,10 @@
 # ROA Oracle Database Setup for Windows
 
+> **Nu ești sigur că acesta e directorul potrivit?**
+> Vezi [`../docs/instalare-si-migrare-oracle.md`](../docs/instalare-si-migrare-oracle.md) —
+> compară acest director cu `migration/` și `new-roa-oracle-server/` și conține arborele
+> de decizie.
+
 > **Status testare ediții Oracle 21c:**
 >
 > | Ediție | Status | Mediu validat |
@@ -17,7 +22,7 @@ Scripts and documentation for setting up ROA Oracle Database on Windows servers:
 | Scenario | Description |
 |----------|-------------|
 | **New Server** | Oracle 21c SE (non-CDB) or XE (CDB/PDB) + CONTAFIN_ORACLE.dmp |
-| **Migration** | Import existing DMP files (CONTAFIN_ORACLE + 30-50 companies) |
+| **Migration** | Import existing DMP files (CONTAFIN_ORACLE + 30-50 companies), inclusiv de pe Oracle XE 11 / 10g |
 | **Add Company** | Add new company schema to existing server |
 
 ---
@@ -92,7 +97,7 @@ roa-windows-setup/
 │   ├── 01-setup-database.ps1    # Tablespace, profile, CONTAFIN_ORACLE user
 │   ├── 02-create-sys-objects.ps1# SYS objects (AUTH_PACK, NEWSCHEMA, etc.)
 │   ├── 03-import-contafin.ps1   # Import CONTAFIN_ORACLE schema
-│   ├── 04-create-synonyms-grants.ps1  # Public synonyms and grants
+│   ├── 04-create-synonyms-grants.ps1  # Public synonyms, grants + sys-grants.sql
 │   ├── 05-import-companies.ps1  # Batch import company schemas
 │   ├── 06-add-company.ps1       # Add new company to existing server
 │   ├── 07-verify-installation.ps1# Verify installation completeness
@@ -134,7 +139,7 @@ roa-windows-setup/
 | `01-setup-database.ps1` | Create tablespace ROA, configure profile, create CONTAFIN_ORACLE user | Yes |
 | `02-create-sys-objects.ps1` | Install SYS objects: AUTH_PACK, NEWSCHEMA, EXECUTESCRIPTOS, UTL_MAIL | Yes |
 | `03-import-contafin.ps1` | Import CONTAFIN_ORACLE schema from DMP | Yes |
-| `04-create-synonyms-grants.ps1` | Create public synonyms and grants for CONTAFIN_ORACLE | Yes |
+| `04-create-synonyms-grants.ps1` | Public synonyms + grants for CONTAFIN_ORACLE, then `sys-grants.sql` (SYS grants, SYS synonyms, DMPDIR, data dictionary reads for `PACK_DIAG_SPATIU`) | Yes |
 | `05-import-companies.ps1` | Batch import company schemas from DMP files | Yes |
 | `06-add-company.ps1` | Add new company to existing server | Optional |
 | `07-verify-installation.ps1` | Verify installation completeness (objects, grants, synonyms) | Yes |
@@ -311,19 +316,84 @@ Copy-Item \\server\dmp\NEWCOMPANY.dmp C:\DMPDIR\
 .\06-add-company.ps1 -CompanyName "NEWCOMPANY" -Password "ROMFASTSOFT"
 ```
 
-### Migration from Oracle 10g
+### Migrare de la un server client existent (Oracle XE 11 / 10g)
+
+Exportul de pe sursă **nu** e automatizat aici — scripturile presupun DMP-urile deja în
+`C:\DMPDIR\` pe serverul nou.
+
+**Sursa Oracle XE 11.2.** `impdp` din 21c acceptă direct seturile Data Pump produse de 11.2,
+deci fără `VERSION=`:
+
+```bat
+REM pe serverul sursă, ca SYSTEM
+sqlplus system/parola@XE
+  CREATE OR REPLACE DIRECTORY DMPDIR AS 'C:\DMPDIR';
+  GRANT READ, WRITE ON DIRECTORY DMPDIR TO SYSTEM;
+
+expdp system/parola@XE SCHEMAS=CONTAFIN_ORACLE DIRECTORY=DMPDIR ^
+      DUMPFILE=contafin_oracle.dmp LOGFILE=export_contafin.log
+
+expdp system/parola@XE SCHEMAS=FIRMA1,FIRMA2 DIRECTORY=DMPDIR ^
+      DUMPFILE=firme_%U.dmp LOGFILE=export_firme.log PARALLEL=2
+REM  ^ %U e substituția Data Pump; din interiorul unui fișier .bat se scrie %%U
+```
+
+Lista schemelor se ia din `CONTAFIN_ORACLE.NOM_FIRME` (`WHERE sters = 0`) — aceeași listă pe
+care `07-verify-installation.ps1` o compară apoi cu schemele existente.
+
+**Sursa Oracle 10g cu `exp` clasic.** Formatele `exp`/`expdp` nu sunt interschimbabile: un
+fișier produs cu `exp` se importă cu `imp`, nu cu `impdp`.
 
 ```powershell
-# 1. Export from Oracle 10g (on source Windows server)
+# 1. Export de pe sursă (exp clasic)
 exp system/password@ORCL file=C:\backup\COMPANY.dmp owner=COMPANY
 
-# 2. Convert with Oracle 21c imp (if needed)
-# Or use impdp with VERSION parameter
-
-# 3. Import using scripts
-.\05-import-companies.ps1 -DmpFile "COMPANY.dmp"
+# 2. Import
+imp system/password@XEPDB1 file=C:\DMPDIR\COMPANY.dmp fromuser=COMPANY touser=COMPANY
 ```
 
+**Înainte de a porni:** verifică plafonul XE (12 GB date de utilizator pe 21c XE, față de
+11 GB pe 11.2 XE):
+
+```sql
+SELECT ROUND(SUM(bytes)/1024/1024/1024, 2) AS gb
+  FROM dba_segments
+ WHERE owner NOT IN ('SYS','SYSTEM','OUTLN','DBSNMP','XDB','APEX_040000');
+```
+
+---
+
+### Scripturile `sys_*` la o migrare — capcana tabelei de versiuni
+
+Obiectele deținute de **SYS nu călătoresc în DMP-ul de schemă**. În schimb, tabela de versiuni
+a lui `PACK_MIGRARE` trăiește în `CONTAFIN_ORACLE` și **vine cu DMP-ul** — iar scripturile
+`sys_*` își înregistrează acolo aplicarea (`pack_migrare.UpdateVersiune(..., 'SYS')`).
+
+Consecința: pe baza nouă, `ROAACTUALIZARI` vede scripturile `sys_*` drept deja aplicate și le
+sare, deși în `SYS` nu există nimic. De aceea obiectele și granturile SYS se pun **la
+instalare**, prin `02-create-sys-objects.ps1` și `04-create-synonyms-grants.ps1`, și nu se
+așteaptă de la actualizator.
+
+Ce e consolidat unde:
+
+| Script sursă (`D:\roa\database\SCRIPTURI_CLAR\`) | Unde e aici |
+|---|---|
+| `sys_2026_01_14_01_AUTH_PACK` | `sql/sys-objects.sql` |
+| `sys_2026_08_08_02_SYS_INFO_TABLESPACE_PURJARE` | `sql/sys-objects.sql` + `sql/scheduler-jobs.sql` |
+| `sys_2026_08_03_05_DIAG_SPATIU_GRANT` | `sql/sys-grants.sql`, secțiunea `[5/5]` |
+| `sys_2026_08_03_07_DIAG_SPATIU_GRANT2` | `sql/sys-grants.sql`, secțiunea `[5/5]` |
+| `sys_2026_08_06_07_DIAG_SPATIU_GRANT3` | `sql/sys-grants.sql`, secțiunea `[5/5]` |
+
+Secțiunea `[5/5]` acordă `SELECT` **direct** pe 18 vederi de dicționar către
+`CONTAFIN_ORACLE`. Grantul prin rolul `DBA` nu ajunge: rolurile nu se aplică în pachetele cu
+drepturi de definitor, iar `CONTAFIN_ORACLE.PACK_DIAG_SPATIU` este exact așa. Fără ele
+pachetul rămâne `INVALID` și jobul `DIAGSPATIU_ZILNIC` nu rulează.
+`07-verify-installation.ps1` raportează care dintre cele 18 lipsesc.
+
+Un `sys_*` nou fie se consolidează în `sys-objects.sql` / `sys-grants.sql` /
+`scheduler-jobs.sql`, fie se pune în [`sql/sys-updates/`](sql/sys-updates/README.md) ca patch
+post-instalare.
+
 ---
 
 ## Uninstall / Cleanup
diff --git a/proxmox/lxc108-oracle/roa-windows-setup/scripts/04-create-synonyms-grants.ps1 b/proxmox/lxc108-oracle/roa-windows-setup/scripts/04-create-synonyms-grants.ps1
index 45d4344..cae13f4 100644
--- a/proxmox/lxc108-oracle/roa-windows-setup/scripts/04-create-synonyms-grants.ps1
+++ b/proxmox/lxc108-oracle/roa-windows-setup/scripts/04-create-synonyms-grants.ps1
@@ -1,221 +1,286 @@
-#Requires -Version 5.1
-
-<#
-.SYNOPSIS
-    Create public synonyms and grants for ROA Oracle.
-
-.DESCRIPTION
-    Creates public synonyms for CONTAFIN_ORACLE objects and configures:
-    - Public synonyms for tables, views, packages, types (via synonyms-public.sql)
-    - Public grants (SELECT, EXECUTE, REFERENCES) (via grants-public.sql)
-    - SESIUNE context
-    - Network ACL for CONTAFIN_ORACLE
-
-.PARAMETER OracleHome
-    Oracle home directory. If not specified, auto-detects.
-
-.PARAMETER ServiceName
-    Database service name. Default: XEPDB1
-
-.PARAMETER SystemPassword
-    SYSTEM user password. Default: romfastsoft
-
-.PARAMETER SqlScriptsDir
-    Directory containing SQL scripts. Default: ..\sql
-
-.EXAMPLE
-    .\04-create-synonyms-grants.ps1
-
-.EXAMPLE
-    .\04-create-synonyms-grants.ps1 -ServiceName "ROA" -SystemPassword "mypassword"
-
-.NOTES
-    File Name      : 04-create-synonyms-grants.ps1
-    Prerequisite   : Run 03-import-contafin.ps1 first
-    Copyright 2024 : ROMFAST
-#>
-
-[CmdletBinding()]
-param(
-    [Parameter(Mandatory = $false)]
-    [string]$OracleHome,
-
-    [Parameter(Mandatory = $false)]
-    [string]$ServiceName = "XEPDB1",
-
-    [Parameter(Mandatory = $false)]
-    [string]$SystemPassword = "romfastsoft",
-
-    [Parameter(Mandatory = $false)]
-    [string]$SqlScriptsDir
-)
-
-$ErrorActionPreference = 'Stop'
-
-# Source library functions
-. "$PSScriptRoot\lib\logging-functions.ps1"
-. "$PSScriptRoot\lib\oracle-functions.ps1"
-
-# Initialize logging
-$logPath = Join-Path $PSScriptRoot "..\logs\04-create-synonyms-grants_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"
-Initialize-LogFile -LogPath $logPath -ScriptName "04-create-synonyms-grants.ps1"
-
-try {
-    Write-LogSection "Creating Public Synonyms and Grants"
-
-    # Validate Oracle installation
-    $oraHome = Get-OracleHome -OracleHome $OracleHome
-    Write-LogSuccess "Oracle Home: $oraHome"
-
-    # Determine SQL scripts directory
-    if (-not $SqlScriptsDir) {
-        $SqlScriptsDir = Join-Path $PSScriptRoot "..\sql"
-    }
-
-    # Verify SQL files exist
-    $synonymsScript = Join-Path $SqlScriptsDir "synonyms-public.sql"
-    $grantsScript = Join-Path $SqlScriptsDir "grants-public.sql"
-
-    if (-not (Test-Path -Path $synonymsScript)) {
-        throw "synonyms-public.sql not found at $synonymsScript"
-    }
-    if (-not (Test-Path -Path $grantsScript)) {
-        throw "grants-public.sql not found at $grantsScript"
-    }
-
-    Write-Log "SQL scripts directory: $SqlScriptsDir"
-
-    # Test connection
-    Write-Log "Testing database connection..."
-    if (-not (Test-OracleConnection -OracleHome $oraHome -ServiceName $ServiceName `
-                -Password $SystemPassword)) {
-        throw "Cannot connect to database. Please verify ServiceName and SystemPassword."
-    }
-    Write-LogSuccess "Database connection successful"
-
-    # Verify CONTAFIN_ORACLE exists and has objects
-    Write-Log "Verifying CONTAFIN_ORACLE schema..."
-    $counts = Get-SchemaObjectCount -OracleHome $oraHome -ServiceName $ServiceName `
-        -Password $SystemPassword -SchemaName "CONTAFIN_ORACLE"
-
-    $totalObjects = if ($counts['TOTAL']) { $counts['TOTAL'] } else { 0 }
-    if ($totalObjects -eq 0) {
-        throw "CONTAFIN_ORACLE schema has no objects. Run 03-import-contafin.ps1 first."
-    }
-    Write-LogSuccess "CONTAFIN_ORACLE has $totalObjects objects"
-
-    # =========================================================================
-    # STEP 1: Create Public Synonyms (using synonyms-public.sql)
-    # =========================================================================
-    Write-LogSection "Creating Public Synonyms"
-    Write-Log "Running synonyms-public.sql..."
-
-    $result = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
-        -Username "SYS" -Password $SystemPassword -SqlFile $synonymsScript -AsSysdba
-
-    if ($result -match "synonym_count|SYNONYM_NAME") {
-        Write-LogSuccess "Public synonyms created successfully"
-    }
-    else {
-        Write-LogWarning "Could not verify synonym creation"
-        Write-LogDebug $result
-    }
-
-    # =========================================================================
-    # STEP 2: Create Grants and ACL (using grants-public.sql)
-    # =========================================================================
-    Write-LogSection "Creating Grants and Network ACL"
-    Write-Log "Running grants-public.sql..."
-
-    $grantsResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
-        -Username "SYS" -Password $SystemPassword -SqlFile $grantsScript -AsSysdba
-
-    if ($grantsResult -match "Grant|ACL|Grants Complete") {
-        Write-LogSuccess "Grants and ACL configured successfully"
-    }
-    else {
-        Write-LogWarning "Could not verify grants configuration"
-        Write-LogDebug $grantsResult
-    }
-
-    # =========================================================================
-    # STEP 3: Verify Results
-    # =========================================================================
-    Write-LogSection "Verifying Configuration"
-
-    # Count synonyms
-    $countSql = @"
-SET PAGESIZE 0 FEEDBACK OFF VERIFY OFF HEADING OFF ECHO OFF
-SELECT 'SYNONYM_COUNT:' || COUNT(*)
-FROM dba_synonyms
-WHERE owner = 'PUBLIC'
-  AND table_owner = 'CONTAFIN_ORACLE';
-EXIT;
-"@
-
-    $countResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
-        -Username "SYSTEM" -Password $SystemPassword -SqlCommand $countSql -Silent
-
-    $synonymCount = 0
-    if ($countResult -match "SYNONYM_COUNT:(\d+)") {
-        $synonymCount = [int]$Matches[1]
-    }
-
-    Write-Log "Public synonyms for CONTAFIN_ORACLE: $synonymCount"
-
-    # Verify SESIUNE context exists (created by grants-public.sql or synonyms-public.sql)
-    $contextSql = @"
-SET PAGESIZE 0 FEEDBACK OFF VERIFY OFF HEADING OFF ECHO OFF
-SELECT 'CONTEXT_EXISTS:' || COUNT(*)
-FROM dba_context
-WHERE namespace = 'SESIUNE';
-EXIT;
-"@
-
-    $contextResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
-        -Username "SYSTEM" -Password $SystemPassword -SqlCommand $contextSql -Silent
-
-    $contextExists = $false
-    if ($contextResult -match "CONTEXT_EXISTS:(\d+)") {
-        $contextExists = [int]$Matches[1] -gt 0
-    }
-
-    if ($contextExists) {
-        Write-LogSuccess "SESIUNE context exists"
-    }
-    else {
-        Write-LogWarning "SESIUNE context not found - creating..."
-        $createContextSql = @"
-CREATE CONTEXT SESIUNE USING CONTAFIN_ORACLE.SET_VARIABILE;
-EXIT;
-"@
-        Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
-            -Username "SYS" -Password $SystemPassword -SqlCommand $createContextSql -AsSysdba
-    }
-
-    # =========================================================================
-    # Summary
-    # =========================================================================
-    Write-LogSection "Setup Complete"
-    Write-LogSuccess "Public synonyms and grants configured!"
-    Write-Log ""
-    Write-Log "Summary:"
-    Write-Log "  SQL scripts used:"
-    Write-Log "    - synonyms-public.sql (all public synonyms)"
-    Write-Log "    - grants-public.sql (all grants and ACL)"
-    Write-Log "  Public synonyms created: $synonymCount"
-    Write-Log "  SESIUNE context:         $(if ($contextExists) { 'Verified' } else { 'Created' })"
-    Write-Log "  Network ACL:             Configured (roaupdate.xml)"
-    Write-Log ""
-    Write-Log "Next steps:"
-    Write-Log "  1. Run 05-import-companies.ps1 to import company schemas"
-
-    Close-LogFile -Success $true
-    exit 0
-}
-catch {
-    Write-LogError "Setup failed: $_"
-    Write-LogError $_.ScriptStackTrace
-    Close-LogFile -Success $false
-    exit 1
-}
+#Requires -Version 5.1
+
+<#
+.SYNOPSIS
+    Create public synonyms and grants for ROA Oracle.
+
+.DESCRIPTION
+    Creates public synonyms for CONTAFIN_ORACLE objects and configures:
+    - Public synonyms for tables, views, packages, types (via synonyms-public.sql)
+    - Public grants (SELECT, EXECUTE, REFERENCES) (via grants-public.sql)
+    - SYS grants, SYS public synonyms, DMPDIR and data dictionary reads
+      required by PACK_DIAG_SPATIU (via sys-grants.sql)
+    - SESIUNE context
+    - Network ACL for CONTAFIN_ORACLE
+
+.PARAMETER OracleHome
+    Oracle home directory. If not specified, auto-detects.
+
+.PARAMETER ServiceName
+    Database service name. Default: XEPDB1
+
+.PARAMETER SystemPassword
+    SYSTEM user password. Default: romfastsoft
+
+.PARAMETER SqlScriptsDir
+    Directory containing SQL scripts. Default: ..\sql
+
+.EXAMPLE
+    .\04-create-synonyms-grants.ps1
+
+.EXAMPLE
+    .\04-create-synonyms-grants.ps1 -ServiceName "ROA" -SystemPassword "mypassword"
+
+.NOTES
+    File Name      : 04-create-synonyms-grants.ps1
+    Prerequisite   : Run 03-import-contafin.ps1 first
+    Copyright 2024 : ROMFAST
+#>
+
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $false)]
+    [string]$OracleHome,
+
+    [Parameter(Mandatory = $false)]
+    [string]$ServiceName = "XEPDB1",
+
+    [Parameter(Mandatory = $false)]
+    [string]$SystemPassword = "romfastsoft",
+
+    [Parameter(Mandatory = $false)]
+    [string]$SqlScriptsDir
+)
+
+$ErrorActionPreference = 'Stop'
+
+# Source library functions
+. "$PSScriptRoot\lib\logging-functions.ps1"
+. "$PSScriptRoot\lib\oracle-functions.ps1"
+
+# Initialize logging
+$logPath = Join-Path $PSScriptRoot "..\logs\04-create-synonyms-grants_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"
+Initialize-LogFile -LogPath $logPath -ScriptName "04-create-synonyms-grants.ps1"
+
+try {
+    Write-LogSection "Creating Public Synonyms and Grants"
+
+    # Validate Oracle installation
+    $oraHome = Get-OracleHome -OracleHome $OracleHome
+    Write-LogSuccess "Oracle Home: $oraHome"
+
+    # Determine SQL scripts directory
+    if (-not $SqlScriptsDir) {
+        $SqlScriptsDir = Join-Path $PSScriptRoot "..\sql"
+    }
+
+    # Verify SQL files exist
+    $synonymsScript = Join-Path $SqlScriptsDir "synonyms-public.sql"
+    $grantsScript = Join-Path $SqlScriptsDir "grants-public.sql"
+    $sysGrantsScript = Join-Path $SqlScriptsDir "sys-grants.sql"
+
+    if (-not (Test-Path -Path $synonymsScript)) {
+        throw "synonyms-public.sql not found at $synonymsScript"
+    }
+    if (-not (Test-Path -Path $grantsScript)) {
+        throw "grants-public.sql not found at $grantsScript"
+    }
+    if (-not (Test-Path -Path $sysGrantsScript)) {
+        throw "sys-grants.sql not found at $sysGrantsScript"
+    }
+
+    Write-Log "SQL scripts directory: $SqlScriptsDir"
+
+    # Test connection
+    Write-Log "Testing database connection..."
+    if (-not (Test-OracleConnection -OracleHome $oraHome -ServiceName $ServiceName `
+                -Password $SystemPassword)) {
+        throw "Cannot connect to database. Please verify ServiceName and SystemPassword."
+    }
+    Write-LogSuccess "Database connection successful"
+
+    # Verify CONTAFIN_ORACLE exists and has objects
+    Write-Log "Verifying CONTAFIN_ORACLE schema..."
+    $counts = Get-SchemaObjectCount -OracleHome $oraHome -ServiceName $ServiceName `
+        -Password $SystemPassword -SchemaName "CONTAFIN_ORACLE"
+
+    $totalObjects = if ($counts['TOTAL']) { $counts['TOTAL'] } else { 0 }
+    if ($totalObjects -eq 0) {
+        throw "CONTAFIN_ORACLE schema has no objects. Run 03-import-contafin.ps1 first."
+    }
+    Write-LogSuccess "CONTAFIN_ORACLE has $totalObjects objects"
+
+    # =========================================================================
+    # STEP 1: Create Public Synonyms (using synonyms-public.sql)
+    # =========================================================================
+    Write-LogSection "Creating Public Synonyms"
+    Write-Log "Running synonyms-public.sql..."
+
+    $result = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+        -Username "SYS" -Password $SystemPassword -SqlFile $synonymsScript -AsSysdba
+
+    if ($result -match "synonym_count|SYNONYM_NAME") {
+        Write-LogSuccess "Public synonyms created successfully"
+    }
+    else {
+        Write-LogWarning "Could not verify synonym creation"
+        Write-LogDebug $result
+    }
+
+    # =========================================================================
+    # STEP 2: Create Grants and ACL (using grants-public.sql)
+    # =========================================================================
+    Write-LogSection "Creating Grants and Network ACL"
+    Write-Log "Running grants-public.sql..."
+
+    $grantsResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+        -Username "SYS" -Password $SystemPassword -SqlFile $grantsScript -AsSysdba
+
+    if ($grantsResult -match "Grant|ACL|Grants Complete") {
+        Write-LogSuccess "Grants and ACL configured successfully"
+    }
+    else {
+        Write-LogWarning "Could not verify grants configuration"
+        Write-LogDebug $grantsResult
+    }
+
+    # =========================================================================
+    # STEP 3: SYS Grants, SYS Synonyms and Dictionary Reads (sys-grants.sql)
+    # =========================================================================
+    # Ruleaza dupa import: tabela de versiuni a lui PACK_MIGRARE traieste in
+    # CONTAFIN_ORACLE si vine cu DMP-ul, marcand scripturile sys_* drept aplicate.
+    # ROAACTUALIZARI nu le mai ruleaza pe baza noua, deci granturile catre SYS
+    # trebuie puse aici, la instalare.
+    Write-LogSection "Creating SYS Grants and Dictionary Reads"
+    Write-Log "Running sys-grants.sql..."
+
+    $sysGrantsResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+        -Username "SYS" -Password $SystemPassword -SqlFile $sysGrantsScript -AsSysdba
+
+    if ($sysGrantsResult -match "SYS Grants and Synonyms Installation Complete") {
+        Write-LogSuccess "SYS grants, synonyms and dictionary reads configured"
+    }
+    else {
+        Write-LogWarning "Could not verify sys-grants.sql execution"
+        Write-LogDebug $sysGrantsResult
+    }
+
+    # =========================================================================
+    # STEP 4: Verify Results
+    # =========================================================================
+    Write-LogSection "Verifying Configuration"
+
+    # Count synonyms
+    $countSql = @"
+SET PAGESIZE 0 FEEDBACK OFF VERIFY OFF HEADING OFF ECHO OFF
+SELECT 'SYNONYM_COUNT:' || COUNT(*)
+FROM dba_synonyms
+WHERE owner = 'PUBLIC'
+  AND table_owner = 'CONTAFIN_ORACLE';
+EXIT;
+"@
+
+    $countResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+        -Username "SYSTEM" -Password $SystemPassword -SqlCommand $countSql -Silent
+
+    $synonymCount = 0
+    if ($countResult -match "SYNONYM_COUNT:(\d+)") {
+        $synonymCount = [int]$Matches[1]
+    }
+
+    Write-Log "Public synonyms for CONTAFIN_ORACLE: $synonymCount"
+
+    # Verify SESIUNE context exists (created by grants-public.sql or synonyms-public.sql)
+    $contextSql = @"
+SET PAGESIZE 0 FEEDBACK OFF VERIFY OFF HEADING OFF ECHO OFF
+SELECT 'CONTEXT_EXISTS:' || COUNT(*)
+FROM dba_context
+WHERE namespace = 'SESIUNE';
+EXIT;
+"@
+
+    $contextResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+        -Username "SYSTEM" -Password $SystemPassword -SqlCommand $contextSql -Silent
+
+    $contextExists = $false
+    if ($contextResult -match "CONTEXT_EXISTS:(\d+)") {
+        $contextExists = [int]$Matches[1] -gt 0
+    }
+
+    if ($contextExists) {
+        Write-LogSuccess "SESIUNE context exists"
+    }
+    else {
+        Write-LogWarning "SESIUNE context not found - creating..."
+        $createContextSql = @"
+CREATE CONTEXT SESIUNE USING CONTAFIN_ORACLE.SET_VARIABILE;
+EXIT;
+"@
+        Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+            -Username "SYS" -Password $SystemPassword -SqlCommand $createContextSql -AsSysdba
+    }
+
+    # Granturile de dictionar cerute de PACK_DIAG_SPATIU (sys-grants.sql [5/5])
+    $dictSql = @"
+SET PAGESIZE 0 FEEDBACK OFF VERIFY OFF HEADING OFF ECHO OFF
+SELECT 'DICT_GRANTS:' || COUNT(*)
+FROM dba_tab_privs
+WHERE grantee = 'CONTAFIN_ORACLE'
+  AND grantor = 'SYS'
+  AND privilege = 'SELECT'
+  AND table_name IN (
+      'DBA_DATA_FILES', 'DBA_FREE_SPACE', 'DBA_TEMP_FILES', 'DBA_SEGMENTS',
+      'DBA_TAB_STATS_HISTORY', 'DBA_SCHEDULER_JOB_RUN_DETAILS', 'DBA_RECYCLEBIN',
+      'V_`$INSTANCE', 'V_`$DATABASE', 'V_`$PARAMETER', 'V_`$TRANSACTION',
+      'V_`$TEMP_SPACE_HEADER', 'V_`$FLASH_RECOVERY_AREA_USAGE',
+      'DBA_TABLESPACES', 'V_`$VERSION',
+      'DBA_LOBS', 'DBA_LOB_PARTITIONS', 'DBA_INDEXES'
+  );
+EXIT;
+"@
+
+    $dictResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+        -Username "SYSTEM" -Password $SystemPassword -SqlCommand $dictSql -Silent
+
+    $dictGrants = 0
+    if ($dictResult -match "DICT_GRANTS:(\d+)") {
+        $dictGrants = [int]$Matches[1]
+    }
+
+    if ($dictGrants -ge 15) {
+        Write-LogSuccess "Dictionary grants for PACK_DIAG_SPATIU: $dictGrants / 18"
+    }
+    else {
+        Write-LogWarning "Dictionary grants for PACK_DIAG_SPATIU: $dictGrants / 18 (asteptat minim 15)"
+        Write-LogWarning "Fara ele PACK_DIAG_SPATIU ramane INVALID si DIAGSPATIU_ZILNIC nu ruleaza."
+        Write-LogWarning "Verifica sectiunea [5/5] din sql\sys-grants.sql"
+    }
+
+    # =========================================================================
+    # Summary
+    # =========================================================================
+    Write-LogSection "Setup Complete"
+    Write-LogSuccess "Public synonyms and grants configured!"
+    Write-Log ""
+    Write-Log "Summary:"
+    Write-Log "  SQL scripts used:"
+    Write-Log "    - synonyms-public.sql (all public synonyms)"
+    Write-Log "    - grants-public.sql (all grants and ACL)"
+    Write-Log "    - sys-grants.sql (SYS grants, SYS synonyms, DMPDIR, dictionary reads)"
+    Write-Log "  Public synonyms created: $synonymCount"
+    Write-Log "  SESIUNE context:         $(if ($contextExists) { 'Verified' } else { 'Created' })"
+    Write-Log "  Network ACL:             Configured (roaupdate.xml)"
+    Write-Log "  Dictionary grants:       $dictGrants / 18 (PACK_DIAG_SPATIU)"
+    Write-Log ""
+    Write-Log "Next steps:"
+    Write-Log "  1. Run 05-import-companies.ps1 to import company schemas"
+
+    Close-LogFile -Success $true
+    exit 0
+}
+catch {
+    Write-LogError "Setup failed: $_"
+    Write-LogError $_.ScriptStackTrace
+    Close-LogFile -Success $false
+    exit 1
+}
diff --git a/proxmox/lxc108-oracle/roa-windows-setup/scripts/07-verify-installation.ps1 b/proxmox/lxc108-oracle/roa-windows-setup/scripts/07-verify-installation.ps1
index ede2d9d..b17304c 100644
--- a/proxmox/lxc108-oracle/roa-windows-setup/scripts/07-verify-installation.ps1
+++ b/proxmox/lxc108-oracle/roa-windows-setup/scripts/07-verify-installation.ps1
@@ -1,515 +1,566 @@
-#Requires -Version 5.1
-
-<#
-.SYNOPSIS
-    Verify ROA Oracle installation.
-
-.DESCRIPTION
-    Performs comprehensive verification of the ROA Oracle installation:
-    - Database info (version, CDB/non-CDB, service name)
-    - Tablespace ROA status
-    - User CONTAFIN_ORACLE status and object count
-    - SYS custom objects status
-    - Public synonyms count
-    - Invalid objects count
-    - Company schemas list with object counts
-
-.PARAMETER OracleHome
-    Oracle home directory. If not specified, auto-detects.
-
-.PARAMETER ServiceName
-    Database service name. Default: XEPDB1
-
-.PARAMETER SystemPassword
-    SYSTEM user password. Default: romfastsoft
-
-.PARAMETER Detailed
-    Show detailed object counts per schema.
-
-.PARAMETER OutputFile
-    Optional path to save verification report.
-
-.EXAMPLE
-    .\07-verify-installation.ps1
-
-.EXAMPLE
-    .\07-verify-installation.ps1 -Detailed -OutputFile "C:\reports\verification.txt"
-
-.EXAMPLE
-    .\07-verify-installation.ps1 -ServiceName "ROA" -SystemPassword "mypassword"
-
-.NOTES
-    File Name      : 07-verify-installation.ps1
-    Prerequisite   : ROA Oracle installation completed
-    Copyright 2024 : ROMFAST
-#>
-
-[CmdletBinding()]
-param(
-    [Parameter(Mandatory = $false)]
-    [string]$OracleHome,
-
-    [Parameter(Mandatory = $false)]
-    [string]$ServiceName = "XEPDB1",
-
-    [Parameter(Mandatory = $false)]
-    [string]$SystemPassword = "romfastsoft",
-
-    [Parameter(Mandatory = $false)]
-    [switch]$Detailed,
-
-    [Parameter(Mandatory = $false)]
-    [string]$OutputFile
-)
-
-$ErrorActionPreference = 'Stop'
-
-# Source library functions
-. "$PSScriptRoot\lib\logging-functions.ps1"
-. "$PSScriptRoot\lib\oracle-functions.ps1"
-
-# Initialize logging
-$logPath = Join-Path $PSScriptRoot "..\logs\07-verify-installation_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"
-Initialize-LogFile -LogPath $logPath -ScriptName "07-verify-installation.ps1"
-
-# Initialize report
-$report = [System.Text.StringBuilder]::new()
-
-function Add-ReportLine {
-    param([string]$Line)
-    [void]$report.AppendLine($Line)
-    Write-Host $Line
-}
-
-function Add-ReportSection {
-    param([string]$Title)
-    Add-ReportLine ""
-    Add-ReportLine ("=" * 60)
-    Add-ReportLine "  $Title"
-    Add-ReportLine ("=" * 60)
-    Add-ReportLine ""
-}
-
-try {
-    Add-ReportSection "ROA Oracle Installation Verification Report"
-    Add-ReportLine "Generated: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
-    Add-ReportLine "Computer:  $env:COMPUTERNAME"
-
-    # Validate Oracle installation
-    $oraHome = Get-OracleHome -OracleHome $OracleHome
-    Write-LogSuccess "Oracle Home: $oraHome"
-
-    # Test connection
-    Write-Log "Testing database connection..."
-    if (-not (Test-OracleConnection -OracleHome $oraHome -ServiceName $ServiceName `
-                -Password $SystemPassword)) {
-        throw "Cannot connect to database. Please verify ServiceName and SystemPassword."
-    }
-    Write-LogSuccess "Database connection successful"
-
-    # Database Information
-    Add-ReportSection "Database Information"
-
-    $dbInfoSql = @"
-SET PAGESIZE 0 FEEDBACK OFF VERIFY OFF HEADING OFF ECHO OFF LINESIZE 500
-SELECT 'VERSION:' || version_full FROM v`$instance;
-SELECT 'EDITION:' || edition FROM v`$instance;
-SELECT 'INSTANCE:' || instance_name FROM v`$instance;
-SELECT 'HOST:' || host_name FROM v`$instance;
-SELECT 'STARTUP:' || TO_CHAR(startup_time, 'YYYY-MM-DD HH24:MI:SS') FROM v`$instance;
-SELECT 'STATUS:' || status FROM v`$instance;
-SELECT 'CDB:' || CDB FROM v`$database;
-SELECT 'DBNAME:' || name FROM v`$database;
-SELECT 'OPEN_MODE:' || open_mode FROM v`$database;
-EXIT;
-"@
-
-    $dbInfo = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
-        -Username "SYSTEM" -Password $SystemPassword -SqlCommand $dbInfoSql -Silent
-
-    $dbData = @{}
-    foreach ($line in $dbInfo -split "`n") {
-        if ($line -match "^([A-Z_]+):(.*)$") {
-            $dbData[$Matches[1]] = $Matches[2].Trim()
-        }
-    }
-
-    Add-ReportLine "Oracle Version:     $($dbData['VERSION'])"
-    Add-ReportLine "Edition:            $($dbData['EDITION'])"
-    Add-ReportLine "Instance Name:      $($dbData['INSTANCE'])"
-    Add-ReportLine "Host Name:          $($dbData['HOST'])"
-    Add-ReportLine "Database Name:      $($dbData['DBNAME'])"
-    Add-ReportLine "CDB Mode:           $($dbData['CDB'])"
-    Add-ReportLine "Open Mode:          $($dbData['OPEN_MODE'])"
-    Add-ReportLine "Instance Status:    $($dbData['STATUS'])"
-    Add-ReportLine "Startup Time:       $($dbData['STARTUP'])"
-    Add-ReportLine "Service Name:       $ServiceName"
-    Add-ReportLine "Oracle Home:        $oraHome"
-
-    # Container Information
-    $containerInfo = Test-PDB -OracleHome $oraHome -ServiceName $ServiceName -Password $SystemPassword
-    Add-ReportLine "Container:          $($containerInfo.ContainerName)"
-    Add-ReportLine "Container ID:       $($containerInfo.ConId)"
-
-    # Tablespace ROA Status
-    Add-ReportSection "Tablespace ROA Status"
-
-    $tsSql = @"
-SET PAGESIZE 100 FEEDBACK OFF VERIFY OFF HEADING ON ECHO OFF LINESIZE 200
-COLUMN tablespace_name FORMAT A20
-COLUMN status FORMAT A10
-COLUMN contents FORMAT A10
-COLUMN allocation_type FORMAT A10
-
-SELECT tablespace_name, status, contents, allocation_type
-FROM dba_tablespaces
-WHERE tablespace_name = 'ROA';
-
-COLUMN file_name FORMAT A60
-COLUMN size_mb FORMAT 999,999.99
-COLUMN maxsize_mb FORMAT 999,999.99
-COLUMN autoextensible FORMAT A5
-
-SELECT file_name,
-       ROUND(bytes/1024/1024, 2) AS size_mb,
-       ROUND(maxbytes/1024/1024, 2) AS maxsize_mb,
-       autoextensible
-FROM dba_data_files
-WHERE tablespace_name = 'ROA';
-EXIT;
-"@
-
-    $tsResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
-        -Username "SYSTEM" -Password $SystemPassword -SqlCommand $tsSql -Silent
-
-    Add-ReportLine $tsResult
-
-    # Check if ROA tablespace exists
-    if ($tsResult -notmatch "ROA") {
-        Add-ReportLine ""
-        Add-ReportLine "[WARNING] Tablespace ROA not found!"
-    }
-
-    # CONTAFIN_ORACLE Status
-    Add-ReportSection "CONTAFIN_ORACLE Schema Status"
-
-    $coExistsSql = @"
-SET PAGESIZE 0 FEEDBACK OFF VERIFY OFF HEADING OFF ECHO OFF
-SELECT 'USER_EXISTS' FROM dba_users WHERE username = 'CONTAFIN_ORACLE';
-EXIT;
-"@
-
-    $coExists = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
-        -Username "SYSTEM" -Password $SystemPassword -SqlCommand $coExistsSql -Silent
-
-    if ($coExists -match "USER_EXISTS") {
-        Add-ReportLine "Status: EXISTS"
-
-        $coCounts = Get-SchemaObjectCount -OracleHome $oraHome -ServiceName $ServiceName `
-            -Password $SystemPassword -SchemaName "CONTAFIN_ORACLE"
-
-        $coTotal = if ($coCounts['TOTAL']) { $coCounts['TOTAL'] } else { 0 }
-        $coInvalid = if ($coCounts['INVALID']) { $coCounts['INVALID'] } else { 0 }
-
-        Add-ReportLine "Total Objects: $coTotal"
-        Add-ReportLine "Invalid Objects: $coInvalid"
-
-        if ($Detailed) {
-            Add-ReportLine ""
-            Add-ReportLine "Object counts by type:"
-            foreach ($key in $coCounts.Keys | Sort-Object) {
-                if ($key -ne 'TOTAL' -and $key -ne 'INVALID') {
-                    Add-ReportLine "  $($key.PadRight(25)) $($coCounts[$key])"
-                }
-            }
-        }
-    }
-    else {
-        Add-ReportLine "Status: NOT FOUND"
-        Add-ReportLine "[WARNING] CONTAFIN_ORACLE user does not exist!"
-    }
-
-    # SYS Custom Objects
-    Add-ReportSection "SYS Custom Objects"
-
-    $sysObjSql = @"
-SET PAGESIZE 100 FEEDBACK OFF VERIFY OFF HEADING ON ECHO OFF LINESIZE 200
-COLUMN object_name FORMAT A30
-COLUMN object_type FORMAT A15
-COLUMN status FORMAT A10
-
-SELECT object_name, object_type, status
-FROM dba_objects
-WHERE owner = 'SYS'
-  AND object_name IN (
-      'AUTH_PACK', 'AUTH_DETALII', 'AUTH_SERII', 'VAUTH_SERII',
-      'PACK_UPDATE', 'PACK_UTILS', 'NEWSCHEMA', 'NEWSCHEMAPOST',
-      'NEWSCHEMAPROGRESS', 'DMPDIR'
-  )
-ORDER BY object_type, object_name;
-EXIT;
-"@
-
-    $sysResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
-        -Username "SYS" -Password $SystemPassword -SqlCommand $sysObjSql -AsSysdba -Silent
-
-    Add-ReportLine $sysResult
-
-    # Public Synonyms Count
-    Add-ReportSection "Public Synonyms"
-
-    $synSql = @"
-SET PAGESIZE 0 FEEDBACK OFF VERIFY OFF HEADING OFF ECHO OFF
-SELECT 'TOTAL_SYNONYMS:' || COUNT(*) FROM dba_synonyms WHERE owner = 'PUBLIC';
-SELECT 'CO_SYNONYMS:' || COUNT(*) FROM dba_synonyms WHERE owner = 'PUBLIC' AND table_owner = 'CONTAFIN_ORACLE';
-SELECT 'SYS_SYNONYMS:' || COUNT(*) FROM dba_synonyms WHERE owner = 'PUBLIC' AND table_owner = 'SYS' AND table_name LIKE 'AUTH%';
-EXIT;
-"@
-
-    $synResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
-        -Username "SYSTEM" -Password $SystemPassword -SqlCommand $synSql -Silent
-
-    $synData = @{}
-    foreach ($line in $synResult -split "`n") {
-        if ($line -match "^([A-Z_]+):(\d+)$") {
-            $synData[$Matches[1]] = [int]$Matches[2]
-        }
-    }
-
-    Add-ReportLine "Total public synonyms:       $($synData['TOTAL_SYNONYMS'])"
-    Add-ReportLine "CONTAFIN_ORACLE synonyms:    $($synData['CO_SYNONYMS'])"
-    Add-ReportLine "SYS AUTH synonyms:           $($synData['SYS_SYNONYMS'])"
-
-    # All Invalid Objects
-    Add-ReportSection "Invalid Objects Summary"
-
-    $invalidSql = @"
-SET PAGESIZE 100 FEEDBACK OFF VERIFY OFF HEADING ON ECHO OFF LINESIZE 200
-COLUMN owner FORMAT A20
-COLUMN invalid_count FORMAT 999,999
-
-SELECT owner, COUNT(*) AS invalid_count
-FROM dba_objects
-WHERE status = 'INVALID'
-  AND owner NOT IN ('SYS', 'SYSTEM', 'OUTLN', 'DBSNMP', 'XDB', 'ORDSYS',
-                    'ORDDATA', 'MDSYS', 'CTXSYS', 'WMSYS', 'APEX_PUBLIC_USER')
-GROUP BY owner
-ORDER BY invalid_count DESC;
-EXIT;
-"@
-
-    $invalidResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
-        -Username "SYSTEM" -Password $SystemPassword -SqlCommand $invalidSql -Silent
-
-    if ($invalidResult.Trim() -eq "" -or $invalidResult -match "no rows selected") {
-        Add-ReportLine "No invalid objects found in application schemas."
-    }
-    else {
-        Add-ReportLine $invalidResult
-    }
-
-    # Company Schemas
-    Add-ReportSection "Company Schemas"
-
-    # Get company list from NOM_FIRME
-    $companySql = @"
-SET PAGESIZE 1000 FEEDBACK OFF VERIFY OFF HEADING OFF ECHO OFF LINESIZE 200
-SELECT schema FROM CONTAFIN_ORACLE.NOM_FIRME WHERE sters = 0 AND schema IS NOT NULL ORDER BY schema;
-EXIT;
-"@
-
-    $companyList = @()
-    try {
-        $companyResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
-            -Username "SYSTEM" -Password $SystemPassword -SqlCommand $companySql -Silent
-
-        foreach ($line in $companyResult -split "`n") {
-            $schema = $line.Trim()
-            if ($schema -match "^[A-Z0-9_]+$") {
-                $companyList += $schema
-            }
-        }
-    }
-    catch {
-        Add-ReportLine "[WARNING] Could not query NOM_FIRME table"
-    }
-
-    Add-ReportLine "Companies registered in NOM_FIRME: $($companyList.Count)"
-    Add-ReportLine ""
-
-    if ($companyList.Count -gt 0) {
-        # Check which schemas exist
-        $existingSql = @"
-SET PAGESIZE 0 FEEDBACK OFF VERIFY OFF HEADING OFF ECHO OFF LINESIZE 200
-SELECT username FROM dba_users WHERE username NOT IN (
-    'SYS', 'SYSTEM', 'OUTLN', 'DBSNMP', 'XDB', 'ORDSYS', 'ORDDATA', 'MDSYS',
-    'CTXSYS', 'WMSYS', 'APEX_PUBLIC_USER', 'CONTAFIN_ORACLE', 'ANONYMOUS',
-    'APEX_040200', 'APEX_050000', 'APPQOSSYS', 'AUDSYS', 'DIP', 'DVF', 'DVSYS',
-    'FLOWS_FILES', 'GGSYS', 'GSMADMIN_INTERNAL', 'GSMCATUSER', 'GSMUSER',
-    'LBACSYS', 'MDDATA', 'OJVMSYS', 'OLAPSYS', 'ORACLE_OCM', 'REMOTE_SCHEDULER_AGENT',
-    'SI_INFORMTN_SCHEMA', 'SPATIAL_CSW_ADMIN_USR', 'SPATIAL_WFS_ADMIN_USR',
-    'SYSBACKUP', 'SYSDG', 'SYSKM', 'SYSRAC', 'XS`$NULL'
-) ORDER BY username;
-EXIT;
-"@
-
-        $existingResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
-            -Username "SYSTEM" -Password $SystemPassword -SqlCommand $existingSql -Silent
-
-        $existingSchemas = @()
-        foreach ($line in $existingResult -split "`n") {
-            $schema = $line.Trim()
-            if ($schema -match "^[A-Z0-9_]+$") {
-                $existingSchemas += $schema
-            }
-        }
-
-        Add-ReportLine "Existing company schemas: $($existingSchemas.Count)"
-        Add-ReportLine ""
-
-        # Show details
-        Add-ReportLine ("Schema".PadRight(25) + "Status".PadRight(12) + "Objects".PadRight(10) + "Invalid")
-        Add-ReportLine ("-" * 60)
-
-        foreach ($schema in $companyList) {
-            $status = if ($existingSchemas -contains $schema) { "EXISTS" } else { "MISSING" }
-
-            if ($status -eq "EXISTS") {
-                $counts = Get-SchemaObjectCount -OracleHome $oraHome -ServiceName $ServiceName `
-                    -Password $SystemPassword -SchemaName $schema
-
-                $total = if ($counts['TOTAL']) { $counts['TOTAL'] } else { 0 }
-                $invalid = if ($counts['INVALID']) { $counts['INVALID'] } else { 0 }
-
-                Add-ReportLine ("$schema".PadRight(25) + "$status".PadRight(12) + "$total".PadRight(10) + "$invalid")
-            }
-            else {
-                Add-ReportLine ("$schema".PadRight(25) + "$status".PadRight(12) + "-".PadRight(10) + "-")
-            }
-        }
-
-        # Check for orphan schemas (exist in DB but not in NOM_FIRME)
-        $orphanSchemas = $existingSchemas | Where-Object { $companyList -notcontains $_ }
-        if ($orphanSchemas.Count -gt 0) {
-            Add-ReportLine ""
-            Add-ReportLine "Orphan schemas (not in NOM_FIRME):"
-            foreach ($schema in $orphanSchemas) {
-                $counts = Get-SchemaObjectCount -OracleHome $oraHome -ServiceName $ServiceName `
-                    -Password $SystemPassword -SchemaName $schema
-
-                $total = if ($counts['TOTAL']) { $counts['TOTAL'] } else { 0 }
-                Add-ReportLine "  - $schema ($total objects)"
-            }
-        }
-    }
-
-    # Network ACL Status
-    Add-ReportSection "Network ACL Status"
-
-    $aclSql = @"
-SET PAGESIZE 100 FEEDBACK OFF VERIFY OFF HEADING ON ECHO OFF LINESIZE 200
-COLUMN acl FORMAT A30
-COLUMN principal FORMAT A20
-COLUMN privilege FORMAT A15
-COLUMN is_grant FORMAT A8
-
-SELECT acl, principal, privilege, is_grant
-FROM dba_network_acl_privileges
-WHERE principal = 'CONTAFIN_ORACLE';
-EXIT;
-"@
-
-    $aclResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
-        -Username "SYS" -Password $SystemPassword -SqlCommand $aclSql -AsSysdba -Silent
-
-    if ($aclResult.Trim() -eq "" -or $aclResult -match "no rows selected") {
-        Add-ReportLine "No ACL configured for CONTAFIN_ORACLE"
-    }
-    else {
-        Add-ReportLine $aclResult
-    }
-
-    # Context Status
-    Add-ReportSection "Context Status"
-
-    $ctxSql = @"
-SET PAGESIZE 100 FEEDBACK OFF VERIFY OFF HEADING ON ECHO OFF LINESIZE 200
-COLUMN namespace FORMAT A20
-COLUMN schema FORMAT A25
-COLUMN package FORMAT A25
-
-SELECT namespace, schema, package
-FROM dba_context
-WHERE namespace = 'SESIUNE';
-EXIT;
-"@
-
-    $ctxResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
-        -Username "SYSTEM" -Password $SystemPassword -SqlCommand $ctxSql -Silent
-
-    if ($ctxResult.Trim() -eq "" -or $ctxResult -match "no rows selected") {
-        Add-ReportLine "SESIUNE context not found"
-    }
-    else {
-        Add-ReportLine $ctxResult
-    }
-
-    # Final Summary
-    Add-ReportSection "Verification Summary"
-
-    $issues = @()
-
-    # Check for issues
-    if ($tsResult -notmatch "ROA") {
-        $issues += "Tablespace ROA not found"
-    }
-
-    if ($coExists -notmatch "USER_EXISTS") {
-        $issues += "CONTAFIN_ORACLE user not found"
-    }
-    elseif ($coCounts -and $coCounts['INVALID'] -gt 0) {
-        $issues += "CONTAFIN_ORACLE has $($coCounts['INVALID']) invalid objects"
-    }
-
-    if ($synData['CO_SYNONYMS'] -eq 0) {
-        $issues += "No public synonyms for CONTAFIN_ORACLE"
-    }
-
-    $missingCompanies = $companyList | Where-Object { $existingSchemas -notcontains $_ }
-    if ($missingCompanies.Count -gt 0) {
-        $issues += "$($missingCompanies.Count) company schemas are missing"
-    }
-
-    if ($issues.Count -eq 0) {
-        Add-ReportLine "[OK] All checks passed!"
-        Add-ReportLine ""
-        Add-ReportLine "The ROA Oracle installation appears to be complete and functional."
-    }
-    else {
-        Add-ReportLine "[WARNING] Issues found:"
-        Add-ReportLine ""
-        foreach ($issue in $issues) {
-            Add-ReportLine "  - $issue"
-        }
-    }
-
-    Add-ReportLine ""
-    Add-ReportLine ("=" * 60)
-    Add-ReportLine "  End of Verification Report"
-    Add-ReportLine ("=" * 60)
-
-    # Save report if requested
-    if ($OutputFile) {
-        Set-Content -Path $OutputFile -Value $report.ToString() -Encoding UTF8
-        Write-LogSuccess "Report saved to: $OutputFile"
-    }
-
-    Close-LogFile -Success ($issues.Count -eq 0)
-    exit $(if ($issues.Count -eq 0) { 0 } else { 1 })
-}
-catch {
-    Write-LogError "Verification failed: $_"
-    Write-LogError $_.ScriptStackTrace
-    Close-LogFile -Success $false
-    exit 1
-}
+#Requires -Version 5.1
+
+<#
+.SYNOPSIS
+    Verify ROA Oracle installation.
+
+.DESCRIPTION
+    Performs comprehensive verification of the ROA Oracle installation:
+    - Database info (version, CDB/non-CDB, service name)
+    - Tablespace ROA status
+    - User CONTAFIN_ORACLE status and object count
+    - SYS custom objects status
+    - Public synonyms count
+    - Invalid objects count
+    - Company schemas list with object counts
+
+.PARAMETER OracleHome
+    Oracle home directory. If not specified, auto-detects.
+
+.PARAMETER ServiceName
+    Database service name. Default: XEPDB1
+
+.PARAMETER SystemPassword
+    SYSTEM user password. Default: romfastsoft
+
+.PARAMETER Detailed
+    Show detailed object counts per schema.
+
+.PARAMETER OutputFile
+    Optional path to save verification report.
+
+.EXAMPLE
+    .\07-verify-installation.ps1
+
+.EXAMPLE
+    .\07-verify-installation.ps1 -Detailed -OutputFile "C:\reports\verification.txt"
+
+.EXAMPLE
+    .\07-verify-installation.ps1 -ServiceName "ROA" -SystemPassword "mypassword"
+
+.NOTES
+    File Name      : 07-verify-installation.ps1
+    Prerequisite   : ROA Oracle installation completed
+    Copyright 2024 : ROMFAST
+#>
+
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $false)]
+    [string]$OracleHome,
+
+    [Parameter(Mandatory = $false)]
+    [string]$ServiceName = "XEPDB1",
+
+    [Parameter(Mandatory = $false)]
+    [string]$SystemPassword = "romfastsoft",
+
+    [Parameter(Mandatory = $false)]
+    [switch]$Detailed,
+
+    [Parameter(Mandatory = $false)]
+    [string]$OutputFile
+)
+
+$ErrorActionPreference = 'Stop'
+
+# Source library functions
+. "$PSScriptRoot\lib\logging-functions.ps1"
+. "$PSScriptRoot\lib\oracle-functions.ps1"
+
+# Initialize logging
+$logPath = Join-Path $PSScriptRoot "..\logs\07-verify-installation_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"
+Initialize-LogFile -LogPath $logPath -ScriptName "07-verify-installation.ps1"
+
+# Initialize report
+$report = [System.Text.StringBuilder]::new()
+
+function Add-ReportLine {
+    param([string]$Line)
+    [void]$report.AppendLine($Line)
+    Write-Host $Line
+}
+
+function Add-ReportSection {
+    param([string]$Title)
+    Add-ReportLine ""
+    Add-ReportLine ("=" * 60)
+    Add-ReportLine "  $Title"
+    Add-ReportLine ("=" * 60)
+    Add-ReportLine ""
+}
+
+try {
+    Add-ReportSection "ROA Oracle Installation Verification Report"
+    Add-ReportLine "Generated: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
+    Add-ReportLine "Computer:  $env:COMPUTERNAME"
+
+    # Validate Oracle installation
+    $oraHome = Get-OracleHome -OracleHome $OracleHome
+    Write-LogSuccess "Oracle Home: $oraHome"
+
+    # Test connection
+    Write-Log "Testing database connection..."
+    if (-not (Test-OracleConnection -OracleHome $oraHome -ServiceName $ServiceName `
+                -Password $SystemPassword)) {
+        throw "Cannot connect to database. Please verify ServiceName and SystemPassword."
+    }
+    Write-LogSuccess "Database connection successful"
+
+    # Database Information
+    Add-ReportSection "Database Information"
+
+    $dbInfoSql = @"
+SET PAGESIZE 0 FEEDBACK OFF VERIFY OFF HEADING OFF ECHO OFF LINESIZE 500
+SELECT 'VERSION:' || version_full FROM v`$instance;
+SELECT 'EDITION:' || edition FROM v`$instance;
+SELECT 'INSTANCE:' || instance_name FROM v`$instance;
+SELECT 'HOST:' || host_name FROM v`$instance;
+SELECT 'STARTUP:' || TO_CHAR(startup_time, 'YYYY-MM-DD HH24:MI:SS') FROM v`$instance;
+SELECT 'STATUS:' || status FROM v`$instance;
+SELECT 'CDB:' || CDB FROM v`$database;
+SELECT 'DBNAME:' || name FROM v`$database;
+SELECT 'OPEN_MODE:' || open_mode FROM v`$database;
+EXIT;
+"@
+
+    $dbInfo = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+        -Username "SYSTEM" -Password $SystemPassword -SqlCommand $dbInfoSql -Silent
+
+    $dbData = @{}
+    foreach ($line in $dbInfo -split "`n") {
+        if ($line -match "^([A-Z_]+):(.*)$") {
+            $dbData[$Matches[1]] = $Matches[2].Trim()
+        }
+    }
+
+    Add-ReportLine "Oracle Version:     $($dbData['VERSION'])"
+    Add-ReportLine "Edition:            $($dbData['EDITION'])"
+    Add-ReportLine "Instance Name:      $($dbData['INSTANCE'])"
+    Add-ReportLine "Host Name:          $($dbData['HOST'])"
+    Add-ReportLine "Database Name:      $($dbData['DBNAME'])"
+    Add-ReportLine "CDB Mode:           $($dbData['CDB'])"
+    Add-ReportLine "Open Mode:          $($dbData['OPEN_MODE'])"
+    Add-ReportLine "Instance Status:    $($dbData['STATUS'])"
+    Add-ReportLine "Startup Time:       $($dbData['STARTUP'])"
+    Add-ReportLine "Service Name:       $ServiceName"
+    Add-ReportLine "Oracle Home:        $oraHome"
+
+    # Container Information
+    $containerInfo = Test-PDB -OracleHome $oraHome -ServiceName $ServiceName -Password $SystemPassword
+    Add-ReportLine "Container:          $($containerInfo.ContainerName)"
+    Add-ReportLine "Container ID:       $($containerInfo.ConId)"
+
+    # Tablespace ROA Status
+    Add-ReportSection "Tablespace ROA Status"
+
+    $tsSql = @"
+SET PAGESIZE 100 FEEDBACK OFF VERIFY OFF HEADING ON ECHO OFF LINESIZE 200
+COLUMN tablespace_name FORMAT A20
+COLUMN status FORMAT A10
+COLUMN contents FORMAT A10
+COLUMN allocation_type FORMAT A10
+
+SELECT tablespace_name, status, contents, allocation_type
+FROM dba_tablespaces
+WHERE tablespace_name = 'ROA';
+
+COLUMN file_name FORMAT A60
+COLUMN size_mb FORMAT 999,999.99
+COLUMN maxsize_mb FORMAT 999,999.99
+COLUMN autoextensible FORMAT A5
+
+SELECT file_name,
+       ROUND(bytes/1024/1024, 2) AS size_mb,
+       ROUND(maxbytes/1024/1024, 2) AS maxsize_mb,
+       autoextensible
+FROM dba_data_files
+WHERE tablespace_name = 'ROA';
+EXIT;
+"@
+
+    $tsResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+        -Username "SYSTEM" -Password $SystemPassword -SqlCommand $tsSql -Silent
+
+    Add-ReportLine $tsResult
+
+    # Check if ROA tablespace exists
+    if ($tsResult -notmatch "ROA") {
+        Add-ReportLine ""
+        Add-ReportLine "[WARNING] Tablespace ROA not found!"
+    }
+
+    # CONTAFIN_ORACLE Status
+    Add-ReportSection "CONTAFIN_ORACLE Schema Status"
+
+    $coExistsSql = @"
+SET PAGESIZE 0 FEEDBACK OFF VERIFY OFF HEADING OFF ECHO OFF
+SELECT 'USER_EXISTS' FROM dba_users WHERE username = 'CONTAFIN_ORACLE';
+EXIT;
+"@
+
+    $coExists = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+        -Username "SYSTEM" -Password $SystemPassword -SqlCommand $coExistsSql -Silent
+
+    if ($coExists -match "USER_EXISTS") {
+        Add-ReportLine "Status: EXISTS"
+
+        $coCounts = Get-SchemaObjectCount -OracleHome $oraHome -ServiceName $ServiceName `
+            -Password $SystemPassword -SchemaName "CONTAFIN_ORACLE"
+
+        $coTotal = if ($coCounts['TOTAL']) { $coCounts['TOTAL'] } else { 0 }
+        $coInvalid = if ($coCounts['INVALID']) { $coCounts['INVALID'] } else { 0 }
+
+        Add-ReportLine "Total Objects: $coTotal"
+        Add-ReportLine "Invalid Objects: $coInvalid"
+
+        if ($Detailed) {
+            Add-ReportLine ""
+            Add-ReportLine "Object counts by type:"
+            foreach ($key in $coCounts.Keys | Sort-Object) {
+                if ($key -ne 'TOTAL' -and $key -ne 'INVALID') {
+                    Add-ReportLine "  $($key.PadRight(25)) $($coCounts[$key])"
+                }
+            }
+        }
+    }
+    else {
+        Add-ReportLine "Status: NOT FOUND"
+        Add-ReportLine "[WARNING] CONTAFIN_ORACLE user does not exist!"
+    }
+
+    # SYS Custom Objects
+    Add-ReportSection "SYS Custom Objects"
+
+    $sysObjSql = @"
+SET PAGESIZE 100 FEEDBACK OFF VERIFY OFF HEADING ON ECHO OFF LINESIZE 200
+COLUMN object_name FORMAT A30
+COLUMN object_type FORMAT A15
+COLUMN status FORMAT A10
+
+SELECT object_name, object_type, status
+FROM dba_objects
+WHERE owner = 'SYS'
+  AND object_name IN (
+      'AUTH_PACK', 'AUTH_DETALII', 'AUTH_SERII', 'VAUTH_SERII',
+      'PACK_UPDATE', 'PACK_UTILS', 'NEWSCHEMA', 'NEWSCHEMAPOST',
+      'NEWSCHEMAPROGRESS', 'DMPDIR'
+  )
+ORDER BY object_type, object_name;
+EXIT;
+"@
+
+    $sysResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+        -Username "SYS" -Password $SystemPassword -SqlCommand $sysObjSql -AsSysdba -Silent
+
+    Add-ReportLine $sysResult
+
+    # Dictionary Grants required by PACK_DIAG_SPATIU
+    Add-ReportSection "Dictionary Grants (PACK_DIAG_SPATIU)"
+
+    $dictSql = @"
+SET PAGESIZE 0 FEEDBACK OFF VERIFY OFF HEADING OFF ECHO OFF LINESIZE 200
+SELECT 'GRANTED:' || table_name
+FROM dba_tab_privs
+WHERE grantee = 'CONTAFIN_ORACLE'
+  AND grantor = 'SYS'
+  AND privilege = 'SELECT'
+ORDER BY table_name;
+EXIT;
+"@
+
+    $dictResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+        -Username "SYSTEM" -Password $SystemPassword -SqlCommand $dictSql -Silent
+
+    $granted = @()
+    foreach ($line in $dictResult -split "`n") {
+        if ($line -match "^GRANTED:(.+)$") { $granted += $Matches[1].Trim() }
+    }
+
+    # Lista din sql\sys-grants.sql, sectiunea [5/5]
+    $expectedDict = @(
+        'DBA_DATA_FILES', 'DBA_FREE_SPACE', 'DBA_TEMP_FILES', 'DBA_SEGMENTS',
+        'DBA_TAB_STATS_HISTORY', 'DBA_SCHEDULER_JOB_RUN_DETAILS', 'DBA_RECYCLEBIN',
+        'V_$INSTANCE', 'V_$DATABASE', 'V_$PARAMETER', 'V_$TRANSACTION',
+        'V_$TEMP_SPACE_HEADER', 'V_$FLASH_RECOVERY_AREA_USAGE',
+        'DBA_TABLESPACES', 'V_$VERSION',
+        'DBA_LOBS', 'DBA_LOB_PARTITIONS', 'DBA_INDEXES'
+    )
+
+    $missingDict = $expectedDict | Where-Object { $granted -notcontains $_ }
+
+    Add-ReportLine "Expected grants: $($expectedDict.Count)"
+    Add-ReportLine "Present grants:  $($expectedDict.Count - $missingDict.Count)"
+
+    if ($missingDict.Count -eq 0) {
+        Add-ReportLine "Status: OK"
+    }
+    else {
+        Add-ReportLine "Status: INCOMPLETE"
+        Add-ReportLine ""
+        Add-ReportLine "Missing:"
+        foreach ($m in $missingDict) { Add-ReportLine "  - $m" }
+        Add-ReportLine ""
+        Add-ReportLine "[WARNING] CONTAFIN_ORACLE.PACK_DIAG_SPATIU va ramane INVALID."
+        Add-ReportLine "          Rolul DBA nu se aplica in pachetele cu drepturi de definitor."
+        Add-ReportLine "          Rezolvare: sqlplus sys/<parola>@$ServiceName as sysdba @sql\sys-grants.sql"
+    }
+
+    # Public Synonyms Count
+    Add-ReportSection "Public Synonyms"
+
+    $synSql = @"
+SET PAGESIZE 0 FEEDBACK OFF VERIFY OFF HEADING OFF ECHO OFF
+SELECT 'TOTAL_SYNONYMS:' || COUNT(*) FROM dba_synonyms WHERE owner = 'PUBLIC';
+SELECT 'CO_SYNONYMS:' || COUNT(*) FROM dba_synonyms WHERE owner = 'PUBLIC' AND table_owner = 'CONTAFIN_ORACLE';
+SELECT 'SYS_SYNONYMS:' || COUNT(*) FROM dba_synonyms WHERE owner = 'PUBLIC' AND table_owner = 'SYS' AND table_name LIKE 'AUTH%';
+EXIT;
+"@
+
+    $synResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+        -Username "SYSTEM" -Password $SystemPassword -SqlCommand $synSql -Silent
+
+    $synData = @{}
+    foreach ($line in $synResult -split "`n") {
+        if ($line -match "^([A-Z_]+):(\d+)$") {
+            $synData[$Matches[1]] = [int]$Matches[2]
+        }
+    }
+
+    Add-ReportLine "Total public synonyms:       $($synData['TOTAL_SYNONYMS'])"
+    Add-ReportLine "CONTAFIN_ORACLE synonyms:    $($synData['CO_SYNONYMS'])"
+    Add-ReportLine "SYS AUTH synonyms:           $($synData['SYS_SYNONYMS'])"
+
+    # All Invalid Objects
+    Add-ReportSection "Invalid Objects Summary"
+
+    $invalidSql = @"
+SET PAGESIZE 100 FEEDBACK OFF VERIFY OFF HEADING ON ECHO OFF LINESIZE 200
+COLUMN owner FORMAT A20
+COLUMN invalid_count FORMAT 999,999
+
+SELECT owner, COUNT(*) AS invalid_count
+FROM dba_objects
+WHERE status = 'INVALID'
+  AND owner NOT IN ('SYS', 'SYSTEM', 'OUTLN', 'DBSNMP', 'XDB', 'ORDSYS',
+                    'ORDDATA', 'MDSYS', 'CTXSYS', 'WMSYS', 'APEX_PUBLIC_USER')
+GROUP BY owner
+ORDER BY invalid_count DESC;
+EXIT;
+"@
+
+    $invalidResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+        -Username "SYSTEM" -Password $SystemPassword -SqlCommand $invalidSql -Silent
+
+    if ($invalidResult.Trim() -eq "" -or $invalidResult -match "no rows selected") {
+        Add-ReportLine "No invalid objects found in application schemas."
+    }
+    else {
+        Add-ReportLine $invalidResult
+    }
+
+    # Company Schemas
+    Add-ReportSection "Company Schemas"
+
+    # Get company list from NOM_FIRME
+    $companySql = @"
+SET PAGESIZE 1000 FEEDBACK OFF VERIFY OFF HEADING OFF ECHO OFF LINESIZE 200
+SELECT schema FROM CONTAFIN_ORACLE.NOM_FIRME WHERE sters = 0 AND schema IS NOT NULL ORDER BY schema;
+EXIT;
+"@
+
+    $companyList = @()
+    try {
+        $companyResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+            -Username "SYSTEM" -Password $SystemPassword -SqlCommand $companySql -Silent
+
+        foreach ($line in $companyResult -split "`n") {
+            $schema = $line.Trim()
+            if ($schema -match "^[A-Z0-9_]+$") {
+                $companyList += $schema
+            }
+        }
+    }
+    catch {
+        Add-ReportLine "[WARNING] Could not query NOM_FIRME table"
+    }
+
+    Add-ReportLine "Companies registered in NOM_FIRME: $($companyList.Count)"
+    Add-ReportLine ""
+
+    if ($companyList.Count -gt 0) {
+        # Check which schemas exist
+        $existingSql = @"
+SET PAGESIZE 0 FEEDBACK OFF VERIFY OFF HEADING OFF ECHO OFF LINESIZE 200
+SELECT username FROM dba_users WHERE username NOT IN (
+    'SYS', 'SYSTEM', 'OUTLN', 'DBSNMP', 'XDB', 'ORDSYS', 'ORDDATA', 'MDSYS',
+    'CTXSYS', 'WMSYS', 'APEX_PUBLIC_USER', 'CONTAFIN_ORACLE', 'ANONYMOUS',
+    'APEX_040200', 'APEX_050000', 'APPQOSSYS', 'AUDSYS', 'DIP', 'DVF', 'DVSYS',
+    'FLOWS_FILES', 'GGSYS', 'GSMADMIN_INTERNAL', 'GSMCATUSER', 'GSMUSER',
+    'LBACSYS', 'MDDATA', 'OJVMSYS', 'OLAPSYS', 'ORACLE_OCM', 'REMOTE_SCHEDULER_AGENT',
+    'SI_INFORMTN_SCHEMA', 'SPATIAL_CSW_ADMIN_USR', 'SPATIAL_WFS_ADMIN_USR',
+    'SYSBACKUP', 'SYSDG', 'SYSKM', 'SYSRAC', 'XS`$NULL'
+) ORDER BY username;
+EXIT;
+"@
+
+        $existingResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+            -Username "SYSTEM" -Password $SystemPassword -SqlCommand $existingSql -Silent
+
+        $existingSchemas = @()
+        foreach ($line in $existingResult -split "`n") {
+            $schema = $line.Trim()
+            if ($schema -match "^[A-Z0-9_]+$") {
+                $existingSchemas += $schema
+            }
+        }
+
+        Add-ReportLine "Existing company schemas: $($existingSchemas.Count)"
+        Add-ReportLine ""
+
+        # Show details
+        Add-ReportLine ("Schema".PadRight(25) + "Status".PadRight(12) + "Objects".PadRight(10) + "Invalid")
+        Add-ReportLine ("-" * 60)
+
+        foreach ($schema in $companyList) {
+            $status = if ($existingSchemas -contains $schema) { "EXISTS" } else { "MISSING" }
+
+            if ($status -eq "EXISTS") {
+                $counts = Get-SchemaObjectCount -OracleHome $oraHome -ServiceName $ServiceName `
+                    -Password $SystemPassword -SchemaName $schema
+
+                $total = if ($counts['TOTAL']) { $counts['TOTAL'] } else { 0 }
+                $invalid = if ($counts['INVALID']) { $counts['INVALID'] } else { 0 }
+
+                Add-ReportLine ("$schema".PadRight(25) + "$status".PadRight(12) + "$total".PadRight(10) + "$invalid")
+            }
+            else {
+                Add-ReportLine ("$schema".PadRight(25) + "$status".PadRight(12) + "-".PadRight(10) + "-")
+            }
+        }
+
+        # Check for orphan schemas (exist in DB but not in NOM_FIRME)
+        $orphanSchemas = $existingSchemas | Where-Object { $companyList -notcontains $_ }
+        if ($orphanSchemas.Count -gt 0) {
+            Add-ReportLine ""
+            Add-ReportLine "Orphan schemas (not in NOM_FIRME):"
+            foreach ($schema in $orphanSchemas) {
+                $counts = Get-SchemaObjectCount -OracleHome $oraHome -ServiceName $ServiceName `
+                    -Password $SystemPassword -SchemaName $schema
+
+                $total = if ($counts['TOTAL']) { $counts['TOTAL'] } else { 0 }
+                Add-ReportLine "  - $schema ($total objects)"
+            }
+        }
+    }
+
+    # Network ACL Status
+    Add-ReportSection "Network ACL Status"
+
+    $aclSql = @"
+SET PAGESIZE 100 FEEDBACK OFF VERIFY OFF HEADING ON ECHO OFF LINESIZE 200
+COLUMN acl FORMAT A30
+COLUMN principal FORMAT A20
+COLUMN privilege FORMAT A15
+COLUMN is_grant FORMAT A8
+
+SELECT acl, principal, privilege, is_grant
+FROM dba_network_acl_privileges
+WHERE principal = 'CONTAFIN_ORACLE';
+EXIT;
+"@
+
+    $aclResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+        -Username "SYS" -Password $SystemPassword -SqlCommand $aclSql -AsSysdba -Silent
+
+    if ($aclResult.Trim() -eq "" -or $aclResult -match "no rows selected") {
+        Add-ReportLine "No ACL configured for CONTAFIN_ORACLE"
+    }
+    else {
+        Add-ReportLine $aclResult
+    }
+
+    # Context Status
+    Add-ReportSection "Context Status"
+
+    $ctxSql = @"
+SET PAGESIZE 100 FEEDBACK OFF VERIFY OFF HEADING ON ECHO OFF LINESIZE 200
+COLUMN namespace FORMAT A20
+COLUMN schema FORMAT A25
+COLUMN package FORMAT A25
+
+SELECT namespace, schema, package
+FROM dba_context
+WHERE namespace = 'SESIUNE';
+EXIT;
+"@
+
+    $ctxResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+        -Username "SYSTEM" -Password $SystemPassword -SqlCommand $ctxSql -Silent
+
+    if ($ctxResult.Trim() -eq "" -or $ctxResult -match "no rows selected") {
+        Add-ReportLine "SESIUNE context not found"
+    }
+    else {
+        Add-ReportLine $ctxResult
+    }
+
+    # Final Summary
+    Add-ReportSection "Verification Summary"
+
+    $issues = @()
+
+    # Check for issues
+    if ($tsResult -notmatch "ROA") {
+        $issues += "Tablespace ROA not found"
+    }
+
+    if ($coExists -notmatch "USER_EXISTS") {
+        $issues += "CONTAFIN_ORACLE user not found"
+    }
+    elseif ($coCounts -and $coCounts['INVALID'] -gt 0) {
+        $issues += "CONTAFIN_ORACLE has $($coCounts['INVALID']) invalid objects"
+    }
+
+    if ($synData['CO_SYNONYMS'] -eq 0) {
+        $issues += "No public synonyms for CONTAFIN_ORACLE"
+    }
+
+    $missingCompanies = $companyList | Where-Object { $existingSchemas -notcontains $_ }
+    if ($missingCompanies.Count -gt 0) {
+        $issues += "$($missingCompanies.Count) company schemas are missing"
+    }
+
+    if ($issues.Count -eq 0) {
+        Add-ReportLine "[OK] All checks passed!"
+        Add-ReportLine ""
+        Add-ReportLine "The ROA Oracle installation appears to be complete and functional."
+    }
+    else {
+        Add-ReportLine "[WARNING] Issues found:"
+        Add-ReportLine ""
+        foreach ($issue in $issues) {
+            Add-ReportLine "  - $issue"
+        }
+    }
+
+    Add-ReportLine ""
+    Add-ReportLine ("=" * 60)
+    Add-ReportLine "  End of Verification Report"
+    Add-ReportLine ("=" * 60)
+
+    # Save report if requested
+    if ($OutputFile) {
+        Set-Content -Path $OutputFile -Value $report.ToString() -Encoding UTF8
+        Write-LogSuccess "Report saved to: $OutputFile"
+    }
+
+    Close-LogFile -Success ($issues.Count -eq 0)
+    exit $(if ($issues.Count -eq 0) { 0 } else { 1 })
+}
+catch {
+    Write-LogError "Verification failed: $_"
+    Write-LogError $_.ScriptStackTrace
+    Close-LogFile -Success $false
+    exit 1
+}
diff --git a/proxmox/lxc108-oracle/roa-windows-setup/sql/sys-grants.sql b/proxmox/lxc108-oracle/roa-windows-setup/sql/sys-grants.sql
index 751259f..201951f 100644
--- a/proxmox/lxc108-oracle/roa-windows-setup/sql/sys-grants.sql
+++ b/proxmox/lxc108-oracle/roa-windows-setup/sql/sys-grants.sql
@@ -24,7 +24,7 @@ PROMPT
 -- SECTION 1: GRANTS TO CONTAFIN_ORACLE
 -- ============================================================================
 PROMPT
-PROMPT [1/4] Granting privileges to CONTAFIN_ORACLE...
+PROMPT [1/5] Granting privileges to CONTAFIN_ORACLE...
 
 -- Execute on SYS packages
 GRANT EXECUTE ON SYS.AUTH_PACK TO CONTAFIN_ORACLE;
@@ -51,7 +51,7 @@ PROMPT   Grants to CONTAFIN_ORACLE complete.
 -- SECTION 2: PUBLIC GRANTS
 -- ============================================================================
 PROMPT
-PROMPT [2/4] Granting public privileges...
+PROMPT [2/5] Granting public privileges...
 
 -- UTL packages for public use
 GRANT EXECUTE ON SYS.UTL_FILE TO PUBLIC;
@@ -62,7 +62,7 @@ PROMPT   Public grants complete.
 -- SECTION 3: SYS PUBLIC SYNONYMS
 -- ============================================================================
 PROMPT
-PROMPT [3/4] Creating SYS public synonyms...
+PROMPT [3/5] Creating SYS public synonyms...
 
 -- Synonyms for SYS procedures
 BEGIN EXECUTE IMMEDIATE 'DROP PUBLIC SYNONYM SYN_NEWSCHEMA'; EXCEPTION WHEN OTHERS THEN NULL; END;
@@ -91,7 +91,7 @@ PROMPT   SYS public synonyms complete.
 -- SECTION 4: DIRECTORY DMPDIR
 -- ============================================================================
 PROMPT
-PROMPT [4/4] Creating DMPDIR directory...
+PROMPT [4/5] Creating DMPDIR directory...
 
 BEGIN
     EXECUTE IMMEDIATE 'CREATE OR REPLACE DIRECTORY DMPDIR AS ''C:\DMPDIR''';
@@ -104,6 +104,72 @@ END;
 
 GRANT READ, WRITE ON DIRECTORY DMPDIR TO PUBLIC;
 
+-- ============================================================================
+-- SECTION 5: GRANTURI DE DICTIONAR PENTRU PACK_DIAG_SPATIU
+-- ============================================================================
+-- Consolideaza scripturile de livrare din repo-ul COMUN:
+--   sys_2026_08_03_05_DIAG_SPATIU_GRANT   - diagnosticul de baza
+--   sys_2026_08_03_07_DIAG_SPATIU_GRANT2  - sectiunea XE (plafon editie)
+--   sys_2026_08_06_07_DIAG_SPATIU_GRANT3  - provenienta segmentelor LOB/index
+--
+-- CONTAFIN_ORACLE.PACK_DIAG_SPATIU are drepturi de definitor, iar rolul DBA NU se
+-- aplica in pachetele cu drepturi de definitor. Referintele statice la dba_*/v$*
+-- au nevoie de grant DIRECT catre user, altfel pachetul ramane INVALID si jobul
+-- DIAGSPATIU_ZILNIC nu ruleaza.
+--
+-- ATENTIE la migrarea unui client existent: tabela de versiuni a lui PACK_MIGRARE
+-- traieste in CONTAFIN_ORACLE si vine cu DMP-ul. Baza noua va raporta scripturile
+-- sys_* de mai sus drept "deja aplicate", iar ROAACTUALIZARI le va sari - desi in
+-- SYS nu exista nimic. De aceea granturile se aplica de aici, la instalare, nu
+-- prin actualizator.
+--
+-- Vederile absente pe versiunea/editia curenta sunt ignorate (ORA-00942).
+-- ============================================================================
+PROMPT
+PROMPT [5/5] Granting data dictionary reads to CONTAFIN_ORACLE (PACK_DIAG_SPATIU)...
+
+DECLARE
+    TYPE t_lista IS TABLE OF VARCHAR2(30);
+    laObiecte t_lista := t_lista(
+        -- sys_2026_08_03_05_DIAG_SPATIU_GRANT
+        'DBA_DATA_FILES', 'DBA_FREE_SPACE', 'DBA_TEMP_FILES',
+        'DBA_SEGMENTS', 'DBA_TAB_STATS_HISTORY',
+        'DBA_SCHEDULER_JOB_RUN_DETAILS', 'DBA_RECYCLEBIN',
+        'V_$INSTANCE', 'V_$DATABASE', 'V_$PARAMETER', 'V_$TRANSACTION',
+        'V_$TEMP_SPACE_HEADER', 'V_$FLASH_RECOVERY_AREA_USAGE',
+        -- sys_2026_08_03_07_DIAG_SPATIU_GRANT2
+        'DBA_TABLESPACES', 'V_$VERSION',
+        -- sys_2026_08_06_07_DIAG_SPATIU_GRANT3
+        'DBA_LOBS', 'DBA_LOB_PARTITIONS', 'DBA_INDEXES'
+    );
+    lnAcordate PLS_INTEGER := 0;
+    lnSarite   PLS_INTEGER := 0;
+BEGIN
+    FOR i IN 1 .. laObiecte.COUNT LOOP
+        BEGIN
+            EXECUTE IMMEDIATE 'GRANT SELECT ON SYS.' || laObiecte(i) ||
+                              ' TO CONTAFIN_ORACLE';
+            lnAcordate := lnAcordate + 1;
+        EXCEPTION
+            WHEN OTHERS THEN
+                IF SQLCODE = -942 THEN
+                    lnSarite := lnSarite + 1;
+                    DBMS_OUTPUT.PUT_LINE('  SKIP (absent pe aceasta versiune): ' ||
+                                         laObiecte(i));
+                ELSE
+                    RAISE;
+                END IF;
+        END;
+    END LOOP;
+
+    DBMS_OUTPUT.PUT_LINE('  Granturi de dictionar acordate: ' || lnAcordate ||
+                         ' / ' || laObiecte.COUNT ||
+                         ' (sarite: ' || lnSarite || ')');
+END;
+/
+
+PROMPT   Dictionary grants complete.
+
 PROMPT
 PROMPT ============================================================
 PROMPT SYS Grants and Synonyms Installation Complete
diff --git a/proxmox/lxc108-oracle/roa-windows-setup/sql/sys-updates/README.md b/proxmox/lxc108-oracle/roa-windows-setup/sql/sys-updates/README.md
index 6cd2ac2..a8e328c 100644
--- a/proxmox/lxc108-oracle/roa-windows-setup/sql/sys-updates/README.md
+++ b/proxmox/lxc108-oracle/roa-windows-setup/sql/sys-updates/README.md
@@ -10,10 +10,21 @@ scripts (`sys_2006_*.sql` through `sys_2026_*.sql`) here.
 
 **Initial setup order:**
 1. `sys-objects.sql` - Creates all SYS objects (tables, packages, procedures, views)
+   — rulat de `scripts/02-create-sys-objects.ps1`
 2. Import `CONTAFIN_ORACLE.dmp` - Application schema
-3. `sys-grants.sql` - Grants and public synonyms
+   — rulat de `scripts/03-import-contafin.ps1`
+3. `sys-grants.sql` - Grants, public synonyms, DMPDIR și granturile de dicționar cerute de
+   `PACK_DIAG_SPATIU` (secțiunea `[5/5]`, consolidând `sys_2026_08_03_05`,
+   `sys_2026_08_03_07` și `sys_2026_08_06_07`)
+   — rulat de `scripts/04-create-synonyms-grants.ps1`, după import
 4. `sys-updates/*.sql` - (Optional) Post-install patches
 
+> **Atenție la migrări.** Tabela de versiuni a lui `PACK_MIGRARE` trăiește în
+> `CONTAFIN_ORACLE` și vine cu DMP-ul, deci pe baza nouă `ROAACTUALIZARI` va considera
+> scripturile `sys_*` deja aplicate și le va sări — deși în `SYS` nu există nimic. Orice
+> `sys_*` necesar unei instalări curate trebuie consolidat în pașii 1-3 de mai sus, nu
+> lăsat pe seama actualizatorului.
+
 ## When to Use This Folder
 
 Place scripts here when you need to:
diff --git a/proxmox/vm302-oracle-test/README.md b/proxmox/vm302-oracle-test/README.md
index 60a2825..90833a2 100644
--- a/proxmox/vm302-oracle-test/README.md
+++ b/proxmox/vm302-oracle-test/README.md
@@ -5,6 +5,11 @@ Scripturile efective trăiesc în `proxmox/lxc108-oracle/roa-windows-setup/`
 (generale, nu legate de VM 302). Acest director documentează **mediul de test**
 și planul de validare.
 
+> VM 302 testează **doar** `roa-windows-setup/`. Scripturile din
+> `proxmox/lxc108-oracle/migration/` nu au mediu de test dedicat — se validează direct pe
+> LXC 108. Ce face fiecare director:
+> [`../lxc108-oracle/docs/instalare-si-migrare-oracle.md`](../lxc108-oracle/docs/instalare-si-migrare-oracle.md).
+
 ## Status testare
 
 | Ediție Oracle | Status | Note |
diff --git a/proxmox/vm302-oracle-test/docs/dual-edition-test-plan.md b/proxmox/vm302-oracle-test/docs/dual-edition-test-plan.md
index aa9f3a3..532f920 100644
--- a/proxmox/vm302-oracle-test/docs/dual-edition-test-plan.md
+++ b/proxmox/vm302-oracle-test/docs/dual-edition-test-plan.md
@@ -65,18 +65,20 @@ Pași pe VM:
    ssh root@10.0.20.201 "qm snapshot 302 se-validated --description 'SE installation validated'"
    ```
 
-### Variantă B — clonă VM 303 dedicată SE
+### Variantă B — clonă dedicată SE (VM 304)
+
+> **VM 303 este ocupat** de `Win11-Adina`. Prima clonă liberă e **304**.
 
 Recomandată dacă vrem să păstrăm ambele medii live pentru regresie.
 
 ```bash
-# Clone VM 302 → 303 (template state, înainte de Oracle XE — TODO: identifică snapshot)
-ssh root@10.0.20.201 "qm clone 302 303 --name oracle-test-303-se --full"
-ssh root@10.0.20.201 "qm start 303"
+# Clone VM 302 → 304 (template state, înainte de Oracle XE — TODO: identifică snapshot)
+ssh root@10.0.20.201 "qm clone 302 304 --name oracle-test-304-se --full"
+ssh root@10.0.20.201 "qm start 304"
 # Schimbă IP-ul Windows: 10.0.20.130 → 10.0.20.131 (sau altul liber)
 ```
 
-Apoi pași 1-5 din varianta A pe VM 303.
+Apoi pași 1-5 din varianta A pe VM 304.
 
 > **Cost spațiu:** clonă full pe local-zfs ≈ 500 GB. Verifică spațiu pvemini
 > înainte (`zfs list local-zfs`).
diff --git a/proxmox/vm302-oracle-test/docs/issues-se-prod.md b/proxmox/vm302-oracle-test/docs/issues-se-prod.md
index 4995473..6a194d9 100644
--- a/proxmox/vm302-oracle-test/docs/issues-se-prod.md
+++ b/proxmox/vm302-oracle-test/docs/issues-se-prod.md
@@ -33,7 +33,7 @@ Pe baza diferențelor SE vs XE (vezi `dual-edition-test-plan.md`):
 
 - [ ] La următoarea instalare prod SE, capturează toate logurile din
       `C:\roa-setup\logs\` și atașează aici
-- [ ] Reproducere pe VM 302 sau clonă VM 303 (vezi `dual-edition-test-plan.md`)
+- [ ] Reproducere pe VM 302 sau clonă VM 304 (vezi `dual-edition-test-plan.md`; VM 303 e ocupat de `Win11-Adina`)
 - [ ] Fix scripturi pe baza erorilor reale
 - [ ] Re-test fresh install SE până trece complet
 - [ ] Update `roa-windows-setup/README.md` — marchează SE ca "tested OK"