> I was not aware of this limitation.

It is a limitation only for the manner you plan to use it. I see it as
a feature. There are some operations that require exclusive access,
like adding an extra database file. Even some table operations like
adding foreign keys can be a pain if users are connected.

The shutdown was designed so that you could gracefully ensure no user
lost their work but still end up with no-one connected. If everyone is
connected as SYSDBA, then that means that this ability for SYSDBA to
connect and make these changes while the database is shutting down is
being exploited.

> This is a major concern for us,
> and will need some fundamental rethinking.

It's not as bad as it probably seems to log everyone in as someone
else. You can still use a surrogate name and still connect everyone
through that user. You will need to issue a batch of grant statements
but I would think there is otherwise little if any code change.

Adam