@@ -10,6 +10,7 @@ Status: experimental, under development. Nothing is published yet.
 - Shared replay preparation (eligibility codes), the `exact` comparison rule and verification reports.
 - HDF5 provenance block (`/DataLab_Provenance`) read and written with h5py alone; links and virtual datasets are refused.
 - Integrity primitives: RFC 8785 canonical JSON, SHA-256 digests, the `datalab-signal-v1` and `datalab-image-v1` state fingerprints (data, coordinates or calibration, units). A state also records the digest of its ROI definition, and an analysis result the digest of its stored value: a saved object whose data, calibration, units or ROI differ from its state is `altered`, and a result replaced by a later analysis is never attributed to the earlier one. Fingerprints are streamed into SHA-256 without copying the arrays.
+- Legacy workspaces: processing records stored by DataLab in object metadata (`__processing_parameters`, `__analysis_parameters`) of objects unknown to the ledger become `legacy_metadata` activities. They keep the record as stored and invent nothing: inputs are bound to the recorded objects (state unknown), the call is opaque without parameters, environment, edition and times are null, and import issues (missing ancestry, unavailable inputs, unsupported operations, version warnings...) are listed. They are never replayed.
 - Capsules (`.dlcapsule`): a ZIP archive holding `workspace.h5` and an RO-Crate 1.3 manifest (`ro-crate-metadata.json`) that conforms to Process Run Crate 0.6 and to the experimental [DataLab capsule profile 0.1](https://datalab-platform.com/capsule/0.1) (terms: `https://datalab-platform.com/capsule/terms#`). The reader refuses unsafe archives (path traversal, duplicates, links, encryption, size and compression-ratio limits) and never accesses the network. It holds the whole archive in memory: it checks the archive size before reading it, then the size of each entry. Each edition passes its own `SizePolicy`; the default one (4 GiB workspace) is an accepted upper bound, not a tested capacity.
 - Pure Python for CPython 3.9+ and Pyodide (Python 3.12). The core only needs the standard library and `jsonschema`; HDF5 helpers use NumPy and h5py.
 - The package never imports DataLab, Sigima, SigimaX or Qt, and never executes code named in a file.
 
@@ -10,7 +10,8 @@
 Binding kinds:
 
 - ``{"state_id": ...}``: a concrete state (used by activities);
-- ``{"object_uuids": [...]}``: an object selection (reserved);
+- ``{"object_uuids": [...]}``: objects whose state at execution time is unknown
+  (only in ``legacy_metadata`` activities, see :mod:`datalab_capsule.legacy`);
 - ``{"step": ..., "role": ...}``: the output of an upstream step (reserved).
 """
 
@@ -35,6 +36,7 @@
 OPERATION_ID_PATTERN = re.compile(r"^[a-z0-9]+(?:[._-][a-z0-9]+)*$")
 BINDING_KINDS = ("state_id", "object_uuids", "step")
 _IMPLEMENTED_BINDINGS = ("state_id",)
+_UUID = re.compile(r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$")
 
 
 class CallError(ProvenanceError, ValueError):
@@ -83,22 +85,37 @@ def is_opaque(call: dict[str, Any]) -> bool:
     return call.get("operation") is None
 
 
-def _check_binding(binding: Any, where: str) -> None:
+def _check_binding(binding: Any, where: str, allow_objects: bool) -> None:
     if not isinstance(binding, dict) or len(binding) == 0:
         raise CallError(f"{where}: binding must be a non-empty object")
     kinds = [kind for kind in BINDING_KINDS if kind in binding]
     if len(kinds) != 1:
         raise CallError(f"{where}: binding must hold exactly one of {BINDING_KINDS}")
     kind = kinds[0]
+    if kind == "object_uuids" and allow_objects:
+        uuids = binding["object_uuids"]
+        if (
+            set(binding) != {"object_uuids"}
+            or not isinstance(uuids, list)
+            or not uuids
+            or not all(isinstance(u, str) and _UUID.match(u) for u in uuids)
+        ):
+            raise CallError(f"{where}: object binding must list object UUIDs")
+        return
     if kind not in _IMPLEMENTED_BINDINGS:
         raise ReservedBindingError(f"{where}: binding kind {kind!r} is reserved")
     if set(binding) != {"state_id"} or not isinstance(binding["state_id"], str):
         raise CallError(f"{where}: state binding must be {{'state_id': <str>}}")
 
 
-def validate_call(call: Any) -> None:
+def validate_call(call: Any, *, allow_object_bindings: bool = False) -> None:
     """Validate the structure of an operation call.
 
+    Args:
+        call: Call to validate.
+        allow_object_bindings: Accept ``object_uuids`` bindings (legacy
+         activities only).
+
     Raises:
         ReservedBindingError: If a reserved binding kind is used.
         CallError: If the call is malformed.
@@ -131,4 +148,4 @@ def validate_call(call: Any) -> None:
             raise CallError(f"{where}: an input holds exactly role and binding")
         if not isinstance(item["role"], str) or not item["role"]:
             raise CallError(f"{where}: role must be a non-empty string")
-        _check_binding(item["binding"], where)
+        _check_binding(item["binding"], where, allow_object_bindings)
@@ -40,8 +40,9 @@
 
 LEDGER_SCHEMA = "datalab-provenance-ledger"
 LEDGER_SCHEMA_VERSION = 1
-#: Origins written today; ``recipe``, ``legacy_metadata`` and ``opaque`` are
-#: reserved and accepted when reading.
+#: Origins written by :meth:`Ledger.record_activity`; ``legacy_metadata`` is
+#: written by :meth:`Ledger.record_legacy_activity`; ``recipe`` and ``opaque``
+#: are reserved and accepted when reading.
 ORIGINS = ("ordinary", "recompute_in_place", "history_replay")
 
 
@@ -106,17 +107,26 @@ def validate_ledger(data: Any) -> None:
         if act_id in activity_ids:
             problems.append(f"{where}: duplicate activity_id")
         activity_ids.add(act_id)
+        legacy = activity["origin"] == "legacy_metadata"
         try:
-            validate_call(activity["call"])
+            validate_call(activity["call"], allow_object_bindings=legacy)
         except CallError as exc:
             problems.append(f"{where}: {exc}")
             continue
         for item in activity["call"]["inputs"]:
-            if item["binding"]["state_id"] not in states:
+            state_id = item["binding"].get("state_id")
+            if state_id is not None and state_id not in states:
                 problems.append(f"{where}: unknown input state")
-        if is_opaque(activity["call"]) and activity["implementation"] is None:
+        if legacy and not is_opaque(activity["call"]):
+            problems.append(f"{where}: a legacy activity is never qualified")
+        if (
+            is_opaque(activity["call"])
+            and activity["implementation"] is None
+            and not legacy
+        ):
             problems.append(f"{where}: an opaque call needs an implementation")
-        if activity["environment_id"] not in environments:
+        env_id = activity["environment_id"]
+        if env_id is not None and env_id not in environments:
             problems.append(f"{where}: unknown environment")
         for output in activity["outputs"]:
             state_id = output.get("state_id")
@@ -385,3 +395,71 @@ def record_activity(
         self._activity_index[activity_id] = len(self._data["activities"])
         self._data["activities"].append(activity)
         return activity
+
+    def record_legacy_activity(
+        self,
+        *,
+        inputs: Iterable[tuple[str, str]],
+        outputs: Iterable[tuple[str, str, dict[str, Any]]],
+        legacy: dict[str, Any],
+        limits: Iterable[str] = (),
+    ) -> dict[str, Any]:
+        """Append an activity rebuilt from processing metadata of an old workspace.
+
+        What the metadata does not say stays unknown: inputs are bound to objects
+        (their state at execution time is unknown), the call is opaque with no
+        parameters, and environment, edition, implementation and times are null.
+        Such an activity is never replayed.
+
+        Args:
+            inputs: Ordered ``(role, object_uuid)`` pairs.
+            outputs: Ordered ``(role, object_uuid, facts)`` triples, observed when
+             the workspace was opened.
+            legacy: ``{"key", "object_uuid", "record", "saved_by_version",
+             "issues"}`` (see :mod:`datalab_capsule.legacy`).
+            limits: Reasons why the activity is not replayable.
+
+        Returns:
+            The appended activity.
+
+        Raises:
+            LedgerError: If the activity is inconsistent.
+        """
+        call = {
+            "operation": None,
+            "parameters": None,
+            "inputs": [
+                {"role": role, "binding": {"object_uuids": [obj_uuid]}}
+                for role, obj_uuid in inputs
+            ],
+        }
+        try:
+            validate_call(call, allow_object_bindings=True)
+        except CallError as exc:
+            raise LedgerError(str(exc)) from exc
+        activity_id = str(uuid.uuid4())
+        activity = {
+            "activity_id": activity_id,
+            "command_id": None,
+            "call": call,
+            "implementation": None,
+            "outputs": [
+                {
+                    "role": role,
+                    "state_id": self._new_state(obj_uuid, facts, activity_id),
+                }
+                for role, obj_uuid, facts in outputs
+            ],
+            "context": {},
+            "limits": list(limits),
+            "environment_id": None,
+            "edition": None,
+            "origin": "legacy_metadata",
+            "status": "completed",
+            "started_at": None,
+            "finished_at": None,
+            "legacy": copy.deepcopy(legacy),
+        }
+        self._activity_index[activity_id] = len(self._data["activities"])
+        self._data["activities"].append(activity)
+        return activity