Improve listener restart wait logic with active polling

- Increase wait time from 10s to max 60s after listener restart
- Add active polling every 5s to check if service is registered
- Log progress while waiting for service registration
- Fixes race condition where script proceeds before service is ready

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

proxmox/lxc108-oracle/roa-windows-setup/scripts/01-setup-database.ps1

@@ -57,6 +57,12 @@ param(
     [Parameter(Mandatory = $false)]
     [string]$ServiceName,
 
+    [Parameter(Mandatory = $false)]
+    [string]$DbHost,
+
+    [Parameter(Mandatory = $false)]
+    [int]$Port = 1521,
+
     [Parameter(Mandatory = $false)]
     [string]$SystemPassword = "romfastsoft",
 
@@ -75,6 +81,20 @@ param(
 
 $ErrorActionPreference = 'Stop'
 
+# Load config.ps1 if exists (provides defaults)
+$configPath = Join-Path (Split-Path $PSScriptRoot -Parent) "config.ps1"
+if (Test-Path $configPath) {
+    . $configPath
+    # Use config values if parameters not provided
+    if (-not $OracleHome -and $ORACLE_HOME) { $OracleHome = $ORACLE_HOME }
+    if (-not $ServiceName -and $SERVICE_NAME) { $ServiceName = $SERVICE_NAME }
+    if (-not $DbHost -and $DB_HOST) { $DbHost = $DB_HOST }
+    if (-not $Port -and $DB_PORT) { $Port = $DB_PORT }
+    if ($SystemPassword -eq "romfastsoft" -and $SYSTEM_PASSWORD) { $SystemPassword = $SYSTEM_PASSWORD }
+    if ($ContafinPassword -eq "ROMFASTSOFT" -and $CONTAFIN_PASSWORD) { $ContafinPassword = $CONTAFIN_PASSWORD }
+    if (-not $DatafileDir -and $DATAFILE_DIR) { $DatafileDir = $DATAFILE_DIR }
+}
+
 # Source library functions
 . "$PSScriptRoot\lib\logging-functions.ps1"
 . "$PSScriptRoot\lib\oracle-functions.ps1"
@@ -98,7 +118,7 @@ try {
 
         # First try to connect to XE to check CDB status
         try {
-            $version = Get-OracleVersion -OracleHome $oraHome -ServiceName "XE" -Password $SystemPassword
+            $version = Get-OracleVersion -OracleHome $oraHome -ServiceName "XE" -DbHost $DbHost -Port $Port -Password $SystemPassword
             if ($version.IsCDB) {
                 $ServiceName = "XEPDB1"
                 Write-Log "Detected CDB installation, using PDB: XEPDB1"
@@ -111,7 +131,7 @@ try {
         catch {
             # Try ROA as fallback
             try {
-                $null = Test-OracleConnection -OracleHome $oraHome -ServiceName "ROA" -Password $SystemPassword
+                $null = Test-OracleConnection -OracleHome $oraHome -ServiceName "ROA" -DbHost $DbHost -Port $Port -Password $SystemPassword
                 $ServiceName = "ROA"
                 Write-Log "Using existing service: ROA"
             }
@@ -123,22 +143,25 @@ try {
     }
 
     Write-LogSuccess "Service Name: $ServiceName"
+    if ($DbHost) {
+        Write-Log "Database Host: ${DbHost}:${Port}"
+    }
 
     # Step 3: Test connection
     Write-Log "Testing database connection..."
-    if (-not (Test-OracleConnection -OracleHome $oraHome -ServiceName $ServiceName -Password $SystemPassword)) {
-        throw "Cannot connect to database. Please verify ServiceName and SystemPassword."
+    if (-not (Test-OracleConnection -OracleHome $oraHome -ServiceName $ServiceName -DbHost $DbHost -Port $Port -Password $SystemPassword)) {
+        throw "Cannot connect to database. Please verify ServiceName, Host and SystemPassword."
     }
     Write-LogSuccess "Database connection successful"
 
     # Get version info
-    $versionInfo = Get-OracleVersion -OracleHome $oraHome -ServiceName $ServiceName -Password $SystemPassword
+    $versionInfo = Get-OracleVersion -OracleHome $oraHome -ServiceName $ServiceName -DbHost $DbHost -Port $Port -Password $SystemPassword
     Write-Log "Oracle Version: $($versionInfo.Version)"
     Write-Log "Oracle Edition: $($versionInfo.Edition)"
     Write-Log "CDB Mode: $($versionInfo.IsCDB)"
 
     # Check container info
-    $containerInfo = Test-PDB -OracleHome $oraHome -ServiceName $ServiceName -Password $SystemPassword
+    $containerInfo = Test-PDB -OracleHome $oraHome -ServiceName $ServiceName -DbHost $DbHost -Port $Port -Password $SystemPassword
     Write-Log "Container: $($containerInfo.ContainerName)"
     if ($containerInfo.IsPDB) {
         Write-Log "Connected to PDB (Pluggable Database)"
@@ -165,7 +188,7 @@ SELECT 'PROFILE_CONFIGURED' FROM dual;
 EXIT;
 "@
 
-    $result = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+    $result = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName -DbHost $DbHost -Port $Port `
         -Username "SYS" -Password $SystemPassword -SqlCommand $profileSql -AsSysdba
 
     if ($result -match "PROFILE_CONFIGURED") {
@@ -255,9 +278,25 @@ NAMES.DIRECTORY_PATH = (TNSNAMES, EZCONNECT)
                 $lsnrOutput = & $lsnrctl start 2>&1
                 Write-LogSuccess "Listener restarted successfully"
 
-                # Wait for services to register
+                # Wait for services to register (can take 30-60 seconds)
                 Write-Log "Waiting for database services to register with listener..."
-                Start-Sleep -Seconds 10
+                $maxWait = 60
+                $waited = 0
+                $interval = 5
+                while ($waited -lt $maxWait) {
+                    Start-Sleep -Seconds $interval
+                    $waited += $interval
+                    # Check if our service is registered
+                    $lsnrStatus = & $lsnrctl status 2>&1 | Out-String
+                    if ($lsnrStatus -match $ServiceName) {
+                        Write-Log "Service $ServiceName registered after ${waited}s"
+                        break
+                    }
+                    Write-Log "Waiting... (${waited}s/${maxWait}s)"
+                }
+                if ($waited -ge $maxWait) {
+                    Write-LogWarning "Service may not be fully registered yet. Continuing anyway..."
+                }
             }
             catch {
                 Write-LogWarning "Could not restart listener: $_"
@@ -286,7 +325,7 @@ SELECT 'TS_EXISTS' FROM dba_tablespaces WHERE tablespace_name = 'ROA';
 EXIT;
 "@
 
-    $tsResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+    $tsResult = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName -DbHost $DbHost -Port $Port `
         -Username "SYSTEM" -Password $SystemPassword -SqlCommand $checkTsSql -Silent
 
     if ($tsResult -match "TS_EXISTS") {
@@ -309,7 +348,7 @@ SELECT 'TS_CREATED' FROM dual;
 EXIT;
 "@
 
-        $result = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+        $result = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName -DbHost $DbHost -Port $Port `
             -Username "SYSTEM" -Password $SystemPassword -SqlCommand $createTsSql
 
         if ($result -match "TS_CREATED") {
@@ -339,7 +378,7 @@ COMMIT;
 SELECT 'PWD_UPDATED' FROM dual;
 EXIT;
 "@
-        $result = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+        $result = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName -DbHost $DbHost -Port $Port `
             -Username "SYSTEM" -Password $SystemPassword -SqlCommand $updatePwdSql -Silent
 
         if ($result -match "PWD_UPDATED") {
@@ -382,7 +421,7 @@ SELECT 'USER_CREATED' FROM dual;
 EXIT;
 "@
 
-        $result = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+        $result = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName -DbHost $DbHost -Port $Port `
             -Username "SYSTEM" -Password $SystemPassword -SqlCommand $createUserSql
 
         if ($result -match "USER_CREATED") {
@@ -402,7 +441,7 @@ SELECT privilege FROM dba_sys_privs WHERE grantee = 'CONTAFIN_ORACLE' ORDER BY p
 EXIT;
 "@
 
-    $privileges = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+    $privileges = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName -DbHost $DbHost -Port $Port `
         -Username "SYSTEM" -Password $SystemPassword -SqlCommand $verifyUserSql -Silent
 
     Write-Log "CONTAFIN_ORACLE privileges verified"
@@ -432,7 +471,7 @@ SELECT 'PWD_RESET_DONE' FROM DUAL;
 EXIT;
 "@
 
-        $result = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+        $result = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName -DbHost $DbHost -Port $Port `
             -Username "SYSTEM" -Password $SystemPassword -SqlCommand $resetPwdSql
 
         if ($result -match "PWD_RESET_DONE") {
@@ -449,7 +488,7 @@ EXIT;
     # Summary
     Write-LogSection "Setup Complete"
     Write-LogSuccess "Database initial setup completed successfully!"
-    Write-Log ""
+    Write-Host ""
     Write-Log "Summary:"
     Write-Log "  Oracle Home:        $oraHome"
     Write-Log "  Service Name:       $ServiceName"
@@ -461,7 +500,7 @@ EXIT;
     if (-not $SkipSqlnetConfig) {
         Write-Log "  Old Client Auth:    Enabled (sqlnet.ora + 10G verifier)"
     }
-    Write-Log ""
+    Write-Host ""
     Write-Log "Next steps:"
     Write-Log "  1. Run 02-create-sys-objects.ps1 to install SYS objects"
     Write-Log "  2. Run 03-import-contafin.ps1 to import CONTAFIN_ORACLE schema"

proxmox/lxc108-oracle/roa-windows-setup/scripts/lib/oracle-functions.ps1

@@ -131,6 +131,12 @@ function Get-OracleVersion {
         [Parameter(Mandatory = $true)]
         [string]$ServiceName,
 
+        [Parameter(Mandatory = $false)]
+        [string]$DbHost,
+
+        [Parameter(Mandatory = $false)]
+        [int]$Port = 1521,
+
         [Parameter(Mandatory = $false)]
         [string]$Username = "SYSTEM",
 
@@ -149,6 +155,7 @@ EXIT;
 "@
 
     $result = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+        -DbHost $DbHost -Port $Port `
         -Username $Username -Password $Password -SqlCommand $sql -Silent
 
     $versionInfo = [PSCustomObject]@{
@@ -201,6 +208,12 @@ function Get-ServiceName {
         [Parameter(Mandatory = $false)]
         [string]$OracleHome,
 
+        [Parameter(Mandatory = $false)]
+        [string]$DbHost,
+
+        [Parameter(Mandatory = $false)]
+        [int]$Port = 1521,
+
         [Parameter(Mandatory = $true)]
         [string]$SystemPassword
     )
@@ -210,6 +223,7 @@ function Get-ServiceName {
     # First try to connect to XE and check if it's CDB
     try {
         $version = Get-OracleVersion -OracleHome $oraHome -ServiceName "XE" `
+            -DbHost $DbHost -Port $Port `
             -Password $SystemPassword -ErrorAction Stop
 
         if ($version.IsCDB) {
@@ -224,6 +238,7 @@ function Get-ServiceName {
         # Try ROA as service name
         try {
             $null = Test-OracleConnection -OracleHome $oraHome -ServiceName "ROA" `
+                -DbHost $DbHost -Port $Port `
                 -Username "SYSTEM" -Password $SystemPassword -ErrorAction Stop
             return "ROA"
         }
@@ -270,6 +285,12 @@ function Test-OracleConnection {
         [Parameter(Mandatory = $true)]
         [string]$ServiceName,
 
+        [Parameter(Mandatory = $false)]
+        [string]$DbHost,
+
+        [Parameter(Mandatory = $false)]
+        [int]$Port = 1521,
+
         [Parameter(Mandatory = $false)]
         [string]$Username = "SYSTEM",
 
@@ -286,6 +307,7 @@ function Test-OracleConnection {
 
     try {
         $result = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+            -DbHost $DbHost -Port $Port `
             -Username $Username -Password $Password -SqlCommand $sql -AsSysdba:$AsSysdba -Silent
 
         return $result -match "CONNECTED"
@@ -330,6 +352,12 @@ function Test-PDB {
         [Parameter(Mandatory = $true)]
         [string]$ServiceName,
 
+        [Parameter(Mandatory = $false)]
+        [string]$DbHost,
+
+        [Parameter(Mandatory = $false)]
+        [int]$Port = 1521,
+
         [Parameter(Mandatory = $false)]
         [string]$Username = "SYSTEM",
 
@@ -347,6 +375,7 @@ EXIT;
 "@
 
     $result = Invoke-SqlPlus -OracleHome $oraHome -ServiceName $ServiceName `
+        -DbHost $DbHost -Port $Port `
         -Username $Username -Password $Password -SqlCommand $sql -Silent
 
     $containerInfo = [PSCustomObject]@{
@@ -428,6 +457,12 @@ function Invoke-SqlPlus {
         [Parameter(Mandatory = $true)]
         [string]$ServiceName,
 
+        [Parameter(Mandatory = $false)]
+        [string]$DbHost,
+
+        [Parameter(Mandatory = $false)]
+        [int]$Port = 1521,
+
         [Parameter(Mandatory = $false)]
         [string]$Username = "SYSTEM",
 
@@ -454,9 +489,13 @@ function Invoke-SqlPlus {
         throw "SQL*Plus not found at: $sqlplus"
     }
 
-    # Build connection string
+    # Build connection string (EZConnect format if DbHost is provided)
     $sysdba = if ($AsSysdba) { " as sysdba" } else { "" }
+    if ($DbHost) {
+        $connString = "$Username/`"$Password`"@${DbHost}:${Port}/${ServiceName}$sysdba"
+    } else {
         $connString = "$Username/`"$Password`"@$ServiceName$sysdba"
+    }
 
     $tempFile = $null
 

proxmox/lxc108-oracle/roa-windows-setup/sql/run-all-sys.sql

@@ -0,0 +1,109 @@
+-- ============================================================================
+-- MASTER SCRIPT: RUN ALL SYS SCRIPTS
+-- ============================================================================
+-- Executes all SYS scripts in correct order:
+--   1. sys-objects.sql - Core objects (AUTH_PACK, tables, procedures)
+--   2. sys-grants.sql - Grants and synonyms
+--   3. sys-updates/*.sql - Additional updates (in alphabetical order)
+--
+-- Usage:
+--   sqlplus sys/password@service as sysdba @run-all-sys.sql
+--
+-- ============================================================================
+
+SET ECHO OFF
+SET FEEDBACK ON
+SET SERVEROUTPUT ON SIZE UNLIMITED
+WHENEVER SQLERROR CONTINUE
+
+PROMPT
+PROMPT ============================================================
+PROMPT     MASTER SYS INSTALLATION
+PROMPT ============================================================
+PROMPT
+
+-- Get script directory (assuming run from sql/ folder)
+DEFINE script_dir = .
+
+-- ============================================================================
+-- STEP 1: Core SYS Objects
+-- ============================================================================
+PROMPT
+PROMPT ============================================================
+PROMPT STEP 1: Installing core SYS objects...
+PROMPT ============================================================
+@sys-objects.sql
+
+-- ============================================================================
+-- STEP 2: SYS Grants and Synonyms
+-- ============================================================================
+PROMPT
+PROMPT ============================================================
+PROMPT STEP 2: Installing SYS grants and synonyms...
+PROMPT ============================================================
+@sys-grants.sql
+
+-- ============================================================================
+-- STEP 3: Additional SYS Updates
+-- ============================================================================
+PROMPT
+PROMPT ============================================================
+PROMPT STEP 3: Running additional SYS updates...
+PROMPT ============================================================
+
+-- Note: SQL*Plus doesn't support dynamic script execution from folder
+-- Use PowerShell script 02-create-sys-objects.ps1 for full automation
+-- Or manually list scripts here:
+
+-- Example:
+-- @sys-updates/2026_01_28_01_example.sql
+
+PROMPT
+PROMPT   To run additional updates, use PowerShell:
+PROMPT   .\scripts\02-create-sys-objects.ps1
+PROMPT
+PROMPT   Or add @sys-updates/scriptname.sql lines above
+PROMPT
+
+-- ============================================================================
+-- VERIFICATION
+-- ============================================================================
+PROMPT
+PROMPT ============================================================
+PROMPT VERIFICATION
+PROMPT ============================================================
+
+PROMPT
+PROMPT SYS custom objects:
+SELECT object_name, object_type, status
+FROM dba_objects
+WHERE owner = 'SYS'
+  AND object_name IN (
+      'AUTH_PACK', 'AUTH_DETALII', 'AUTH_SERII', 'VAUTH_SERII',
+      'EXECUTESCRIPTOS', 'NEWSCHEMA', 'NEWSCHEMAJOB', 'UPDATESQLPLUS',
+      'PINFO', 'INFO', 'SEQ_AUTH_SERII'
+  )
+ORDER BY object_type, object_name;
+
+PROMPT
+PROMPT SYS public synonyms:
+SELECT synonym_name, table_owner, table_name
+FROM dba_synonyms
+WHERE owner = 'PUBLIC'
+  AND table_owner = 'SYS'
+  AND synonym_name IN ('SYN_NEWSCHEMA', 'SYN_NEWSCHEMAJOB', 'EXECUTESCRIPTOS', 'SYN_PINFO')
+ORDER BY synonym_name;
+
+PROMPT
+PROMPT CONTAFIN_ORACLE grants from SYS:
+SELECT privilege, table_name
+FROM dba_tab_privs
+WHERE grantee = 'CONTAFIN_ORACLE'
+  AND grantor = 'SYS'
+ORDER BY table_name;
+
+PROMPT
+PROMPT ============================================================
+PROMPT     MASTER SYS INSTALLATION COMPLETE
+PROMPT ============================================================
+PROMPT

proxmox/lxc108-oracle/roa-windows-setup/sql/sys-grants.sql

@@ -0,0 +1,111 @@
+-- ============================================================================
+-- SYS GRANTS AND SYNONYMS FOR ROA APPLICATION
+-- ============================================================================
+-- Run AFTER sys-objects.sql and AFTER CONTAFIN_ORACLE import
+-- These grants enable CONTAFIN_ORACLE packages to work correctly
+--
+-- Usage:
+--   sqlplus sys/password@service as sysdba @sys-grants.sql
+--
+-- ============================================================================
+
+SET ECHO OFF
+SET FEEDBACK ON
+SET SERVEROUTPUT ON SIZE UNLIMITED
+WHENEVER SQLERROR CONTINUE
+
+PROMPT
+PROMPT ============================================================
+PROMPT Installing SYS Grants and Synonyms
+PROMPT ============================================================
+PROMPT
+
+-- ============================================================================
+-- SECTION 1: GRANTS TO CONTAFIN_ORACLE
+-- ============================================================================
+PROMPT
+PROMPT [1/4] Granting privileges to CONTAFIN_ORACLE...
+
+-- Execute on SYS packages
+GRANT EXECUTE ON SYS.AUTH_PACK TO CONTAFIN_ORACLE;
+GRANT EXECUTE ON SYS.DBMS_SCHEDULER TO CONTAFIN_ORACLE;
+GRANT EXECUTE ON SYS.DBMS_LOCK TO CONTAFIN_ORACLE;
+GRANT EXECUTE ON SYS.UTL_INADDR TO CONTAFIN_ORACLE;
+GRANT EXECUTE ON SYS.UTL_FILE TO CONTAFIN_ORACLE;
+GRANT EXECUTE ON SYS.UTL_SMTP TO CONTAFIN_ORACLE;
+GRANT EXECUTE ON SYS.UTL_TCP TO CONTAFIN_ORACLE;
+GRANT EXECUTE ON SYS.DBMS_CRYPTO TO CONTAFIN_ORACLE;
+
+-- Directory privileges
+GRANT CREATE ANY DIRECTORY TO CONTAFIN_ORACLE;
+GRANT DROP ANY DIRECTORY TO CONTAFIN_ORACLE;
+
+-- Scheduler privileges
+GRANT CREATE JOB TO CONTAFIN_ORACLE;
+GRANT CREATE EXTERNAL JOB TO CONTAFIN_ORACLE;
+GRANT MANAGE SCHEDULER TO CONTAFIN_ORACLE;
+
+PROMPT   Grants to CONTAFIN_ORACLE complete.
+
+-- ============================================================================
+-- SECTION 2: PUBLIC GRANTS
+-- ============================================================================
+PROMPT
+PROMPT [2/4] Granting public privileges...
+
+-- UTL packages for public use
+GRANT EXECUTE ON SYS.UTL_FILE TO PUBLIC;
+
+PROMPT   Public grants complete.
+
+-- ============================================================================
+-- SECTION 3: SYS PUBLIC SYNONYMS
+-- ============================================================================
+PROMPT
+PROMPT [3/4] Creating SYS public synonyms...
+
+-- Synonyms for SYS procedures
+BEGIN EXECUTE IMMEDIATE 'DROP PUBLIC SYNONYM SYN_NEWSCHEMA'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP PUBLIC SYNONYM SYN_NEWSCHEMAJOB'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP PUBLIC SYNONYM EXECUTESCRIPTOS'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP PUBLIC SYNONYM SYN_PINFO'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+
+CREATE PUBLIC SYNONYM SYN_NEWSCHEMA FOR SYS.NEWSCHEMA;
+CREATE PUBLIC SYNONYM SYN_NEWSCHEMAJOB FOR SYS.NEWSCHEMAJOB;
+CREATE PUBLIC SYNONYM EXECUTESCRIPTOS FOR SYS.EXECUTESCRIPTOS;
+CREATE PUBLIC SYNONYM SYN_PINFO FOR SYS.PINFO;
+
+-- Grants on synonyms
+GRANT EXECUTE ON SYN_NEWSCHEMA TO PUBLIC;
+GRANT EXECUTE ON SYN_NEWSCHEMAJOB TO PUBLIC;
+GRANT EXECUTE ON EXECUTESCRIPTOS TO PUBLIC;
+GRANT EXECUTE ON SYN_PINFO TO PUBLIC;
+
+PROMPT   SYS public synonyms complete.
+
+-- ============================================================================
+-- SECTION 4: DIRECTORY DMPDIR
+-- ============================================================================
+PROMPT
+PROMPT [4/4] Creating DMPDIR directory...
+
+BEGIN
+    EXECUTE IMMEDIATE 'CREATE OR REPLACE DIRECTORY DMPDIR AS ''C:\DMPDIR''';
+    DBMS_OUTPUT.PUT_LINE('  Directory DMPDIR created.');
+EXCEPTION
+    WHEN OTHERS THEN
+        DBMS_OUTPUT.PUT_LINE('  Directory DMPDIR: ' || SQLERRM);
+END;
+/
+
+GRANT READ, WRITE ON DIRECTORY DMPDIR TO PUBLIC;
+
+PROMPT
+PROMPT ============================================================
+PROMPT SYS Grants and Synonyms Installation Complete
+PROMPT ============================================================
+PROMPT

proxmox/lxc108-oracle/roa-windows-setup/sql/sys-updates/README.md

@@ -0,0 +1,61 @@
+# SYS Updates Folder
+
+This folder is for **future patches and updates only**, not for initial setup.
+
+## Important Note
+
+The initial SYS objects (AUTH_PACK, NEWSCHEMA, EXECUTESCRIPTOS, etc.) are already
+consolidated in `../sys-objects.sql`. You do NOT need to copy the old individual
+scripts (`sys_2006_*.sql` through `sys_2026_*.sql`) here.
+
+**Initial setup order:**
+1. `sys-objects.sql` - Creates all SYS objects (tables, packages, procedures, views)
+2. Import `CONTAFIN_ORACLE.dmp` - Application schema
+3. `sys-grants.sql` - Grants and public synonyms
+4. `sys-updates/*.sql` - (Optional) Post-install patches
+
+## When to Use This Folder
+
+Place scripts here when you need to:
+- Add new grants or privileges after initial setup
+- Patch AUTH_PACK or other SYS objects
+- Add new SYS procedures/functions
+- Fix issues discovered after deployment
+
+## Naming Convention
+
+Use date-based naming for proper ordering:
+```
+YYYY_MM_DD_##_DESCRIPTION.sql
+```
+
+Examples:
+- `2026_02_15_01_AUTH_PACK_FIX.sql`
+- `2026_03_01_01_NEW_GRANT.sql`
+
+## How Scripts Are Executed
+
+1. The `run-sys-updates.sql` master script executes all `.sql` files in this folder
+2. Scripts run in alphabetical order (hence the date prefix)
+3. Each script should be idempotent (safe to run multiple times)
+
+## Template
+
+```sql
+-- ============================================================================
+-- YYYY_MM_DD_##_DESCRIPTION
+-- ============================================================================
+-- Author: Your Name
+-- Date: YYYY-MM-DD
+-- Description: What this script does
+-- ============================================================================
+
+SET SERVEROUTPUT ON
+WHENEVER SQLERROR CONTINUE
+
+-- Your SQL here
+
+-- Update version tracking (optional)
+-- EXEC CONTAFIN_ORACLE.PACK_MIGRARE.UpdateVersiune('sys_YYYY_MM_DD_##_DESCRIPTION','','SYS');
+-- COMMIT;
+```