diff --git a/Cargo.lock b/Cargo.lock
index e0ad93b15..b7b3ad898 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1522,6 +1522,7 @@ dependencies = [
  "krishiv-plan",
  "krishiv-sql",
  "krishiv-types",
+ "krishiv-udf-sdk",
  "loom",
  "object_store",
  "proptest",
@@ -1548,6 +1549,7 @@ dependencies = [
  "krishiv-common",
  "krishiv-kernels",
  "krishiv-types",
+ "krishiv-udf-sdk",
  "regex-automata",
  "regex-syntax",
 ]
@@ -1639,6 +1641,7 @@ dependencies = [
  "krishiv-plan",
  "krishiv-sql",
  "krishiv-types",
+ "krishiv-udf-sdk",
  "proptest",
  "serde_json",
 ]
@@ -1656,6 +1659,7 @@ dependencies = [
  "krishiv-io",
  "krishiv-kernels",
  "krishiv-types",
+ "krishiv-udf-sdk",
  "proptest",
  "serde_json",
  "thiserror",
@@ -1724,12 +1728,14 @@ dependencies = [
  "insta",
  "krishiv-common",
  "krishiv-exec",
+ "krishiv-functions",
  "krishiv-io",
  "krishiv-memory",
  "krishiv-optimizer",
  "krishiv-plan",
  "krishiv-sql",
  "krishiv-types",
+ "krishiv-udf-sdk",
  "object_store",
  "parquet",
  "serde_json",
@@ -1818,6 +1824,10 @@ dependencies = [
 [[package]]
 name = "krishiv-udf-sdk"
 version = "0.1.0-alpha"
+dependencies = [
+ "arrow-array",
+ "krishiv-types",
+]
 
 [[package]]
 name = "krishiv-ui-assets"
diff --git a/crates/krishiv-common/krishiv-error-classes.json b/crates/krishiv-common/krishiv-error-classes.json
index c125cb04a..6dcdf4219 100644
--- a/crates/krishiv-common/krishiv-error-classes.json
+++ b/crates/krishiv-common/krishiv-error-classes.json
@@ -113,6 +113,12 @@
     ],
     "sqlState" : "42K0I"
   },
+  "KRISHIV_UDF_NOT_AVAILABLE" : {
+    "message" : [
+      "The user-defined function <name>@<version> is not available on this worker: register it on the executing session before running the plan."
+    ],
+    "sqlState" : "39000"
+  },
   "KRISHIV_UNKNOWN_FORMAT_OPTION" : {
     "message" : [
       "The option <option> is not an option of the <format> data source.<suggestion> Remove it, or set \"krishiv.io.strictOptions\" to \"false\" to ignore unknown options with a warning."
diff --git a/crates/krishiv-exec/Cargo.toml b/crates/krishiv-exec/Cargo.toml
index 19ca0a742..b01426153 100644
--- a/crates/krishiv-exec/Cargo.toml
+++ b/crates/krishiv-exec/Cargo.toml
@@ -29,6 +29,7 @@ krishiv-memory = { path = "../krishiv-memory" }
 krishiv-optimizer = { path = "../krishiv-optimizer" }
 krishiv-plan = { path = "../krishiv-plan" }
 krishiv-types = { path = "../krishiv-types" }
+krishiv-udf-sdk = { path = "../krishiv-udf-sdk" }
 thiserror.workspace = true
 # The query profile's JSON document (`profile`).
 serde_json = { workspace = true, features = ["std"] }
@@ -56,6 +57,10 @@ loom = { workspace = true, features = ["futures"] }
 # Row-layout key-page prototype (P2-T157); not part of the default build.
 row-table-prototype = []
 
+[[bench]]
+name = "udf"
+harness = false
+
 [[bench]]
 name = "pipeline"
 harness = false
diff --git a/crates/krishiv-exec/benches/udf.rs b/crates/krishiv-exec/benches/udf.rs
new file mode 100644
index 000000000..7ae272cab
--- /dev/null
+++ b/crates/krishiv-exec/benches/udf.rs
@@ -0,0 +1,129 @@
+// SPDX-License-Identifier: Apache-2.0
+//! An identity UDF against the built-in it mirrors: invoking each over
+//! 8,192-row batches, through the same [`ScalarFunction`] interface the
+//! evaluator uses. The UDF's per-batch cost over `abs` is the wrapper
+//! (checks, null masks, unwind boundary): the identity itself copies its
+//! input in both cases.
+
+#![expect(
+    missing_docs,
+    reason = "criterion_group! generates an undocumented function"
+)]
+
+use std::hint::black_box;
+use std::sync::Arc;
+
+use arrow_array::{ArrayRef, Int32Array};
+use arrow_schema::DataType;
+use criterion::{BenchmarkId, Criterion, Throughput, criterion_group, criterion_main};
+use krishiv_functions::scalar::{Arg, BindArg, BindOptions, ScalarFunction, bind_scalar, bind_udf};
+use krishiv_types::DataType as SparkType;
+use krishiv_udf_sdk::{
+    ArgField, InvokeContext, ReturnField, ScalarUdf, Signature, UdfArg, UdfError, UdfInputType,
+};
+
+const ROWS: usize = 8_192;
+
+/// The identity over `INT`.
+#[derive(Debug)]
+struct Identity;
+
+impl ScalarUdf for Identity {
+    fn name(&self) -> &str {
+        "identity_i32"
+    }
+
+    fn version(&self) -> u32 {
+        1
+    }
+
+    fn signature(&self) -> &Signature {
+        use std::sync::OnceLock;
+        static SIG: OnceLock<Signature> = OnceLock::new();
+        SIG.get_or_init(|| Signature::Exact(vec![UdfInputType::Exact(SparkType::Integer)]))
+    }
+
+    fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+        Ok(ReturnField {
+            data_type: SparkType::Integer,
+            nullable: false,
+        })
+    }
+
+    fn invoke(
+        &self,
+        args: &[UdfArg<'_>],
+        _: usize,
+        _: &InvokeContext,
+    ) -> Result<ArrayRef, UdfError> {
+        Ok(args[0].array())
+    }
+}
+
+fn batch() -> ArrayRef {
+    // Negative and positive values, so `abs` computes on every row.
+    Arc::new(Int32Array::from_iter_values(
+        (0..ROWS).map(|i| i32::try_from(i).unwrap_or(0).wrapping_sub(4096)),
+    ))
+}
+
+#[expect(
+    clippy::expect_used,
+    reason = "a broken fixture must fail the bench loudly, not skip it"
+)]
+fn bound_abs() -> Arc<dyn ScalarFunction> {
+    bind_scalar(
+        "abs",
+        &[BindArg::Column {
+            ty: DataType::Int32,
+            nullable: true,
+        }],
+        &BindOptions::new(),
+    )
+    .expect("abs(int)")
+}
+
+#[expect(
+    clippy::expect_used,
+    reason = "a broken fixture must fail the bench loudly, not skip it"
+)]
+fn bound_identity() -> Arc<dyn ScalarFunction> {
+    let udf: Arc<dyn ScalarUdf> = Arc::new(Identity);
+    bind_udf(
+        &udf,
+        &[DataType::Int32],
+        &SparkType::Integer,
+        false,
+        true,
+        None,
+    )
+    .expect("identity")
+}
+
+#[expect(
+    clippy::expect_used,
+    reason = "a failed invocation must fail the bench loudly, not skip it"
+)]
+fn bench(c: &mut Criterion) {
+    let mut group = c.benchmark_group("udf");
+    group.throughput(Throughput::Elements(ROWS as u64));
+    let input = batch();
+    for (id, bound) in [("abs", bound_abs()), ("identity_udf", bound_identity())] {
+        group.bench_with_input(
+            BenchmarkId::new("invoke_8192_rows", id),
+            &bound,
+            |b, bound: &Arc<dyn ScalarFunction>| {
+                b.iter(|| {
+                    let out = bound
+                        .invoke(black_box(&[Arg::Array(Arc::clone(&input))]), ROWS)
+                        .expect("invoke");
+                    black_box(out.len())
+                });
+            },
+        );
+    }
+    group.finish();
+}
+
+criterion_group!(benches, bench);
+criterion_main!(benches);
diff --git a/crates/krishiv-exec/src/physical/instantiate.rs b/crates/krishiv-exec/src/physical/instantiate.rs
index fc9b4a517..42ea8506a 100644
--- a/crates/krishiv-exec/src/physical/instantiate.rs
+++ b/crates/krishiv-exec/src/physical/instantiate.rs
@@ -47,6 +47,7 @@ use krishiv_io::{
 };
 use krishiv_memory::SpillScope;
 use krishiv_plan::{AttrId, Expr};
+use krishiv_udf_sdk::UdfLibrary;
 use object_store::path::Path;
 
 use super::{
@@ -88,13 +89,15 @@ pub trait SpillScopes: Send + Sync + fmt::Debug {
 }
 
 /// What a worker resolves a plan's references against: the tables its
-/// scans read, the relation store its batch splits resolve through, the
-/// spill scope of the query, the I/O context, formats and configuration a
-/// write builds its sink from, and the values of the plan. One per query
+/// scans read, the session UDFs its function calls invoke, the relation store
+/// its batch splits resolve through, the spill scope of the query, the I/O
+/// context, formats and configuration a write builds its sink from, and the
+/// values of the plan. One per query
 /// and worker.
 #[derive(Clone)]
 pub struct WorkerContext {
     tables: Arc<dyn TableProviderResolver>,
+    udfs: Option<Arc<UdfLibrary>>,
     relations: Option<Arc<krishiv_memory::RelationStore>>,
     spill: Option<SpillScope>,
     scopes: Option<Arc<dyn SpillScopes>>,
@@ -152,6 +155,7 @@ impl WorkerContext {
     pub fn new(tables: Arc<dyn TableProviderResolver>) -> Self {
         Self {
             tables,
+            udfs: None,
             relations: None,
             spill: None,
             scopes: None,
@@ -163,6 +167,14 @@ impl WorkerContext {
         }
     }
 
+    /// The same context invoking session UDFs from `udfs`. A plan calling
+    /// a UDF the context lacks fails with `KRISHIV_UDF_NOT_AVAILABLE`.
+    #[must_use]
+    pub fn with_udfs(mut self, udfs: Arc<UdfLibrary>) -> Self {
+        self.udfs = Some(udfs);
+        self
+    }
+
     /// The same context resolving a scan's batch splits (the
     /// [`ScanSplits::Batches`] of its task) through `relations`: the
     /// session's relation store.
@@ -245,6 +257,7 @@ impl fmt::Debug for WorkerContext {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         f.debug_struct("WorkerContext")
             .field("tables", &self.tables)
+            .field("udfs", &self.udfs.is_some())
             .field("relations", &self.relations.is_some())
             .field("spill", &self.spill.is_some())
             .field("spill_scopes", &self.scopes.is_some())
@@ -277,11 +290,14 @@ pub fn instantiate_task(
             (None, Some(scopes)) => Some(scopes.scope()?),
             (None, None) => None,
         };
+        let mut env = EvalEnv::from_plan(plan.env());
+        // The UDFs travel with the worker, never with the plan.
+        env.udfs = worker.udfs.clone();
         let mut cx = Instantiation {
             worker,
             task: task.clone(),
             spill,
-            env: EvalEnv::from_plan(plan.env()),
+            env,
             values: worker
                 .values
                 .clone()
diff --git a/crates/krishiv-exec/src/planner/build.rs b/crates/krishiv-exec/src/planner/build.rs
index 7f404d997..6d772ef2c 100644
--- a/crates/krishiv-exec/src/planner/build.rs
+++ b/crates/krishiv-exec/src/planner/build.rs
@@ -181,9 +181,13 @@ pub(crate) struct Planner<'a> {
 impl<'a> Planner<'a> {
     fn new(cx: &'a PlanningContext, root: &LogicalPlan) -> Self {
         let next_id = max_id(root).saturating_add(1).max(1 << 62);
+        let mut env = EvalEnv::new(&cx.config, Arc::clone(&cx.user));
+        // Planning validates UDF calls against the session's library; the
+        // implementation a plan runs comes from its worker.
+        env.udfs = cx.udfs.clone();
         Self {
             cx,
-            env: EvalEnv::new(&cx.config, Arc::clone(&cx.user)),
+            env,
             warnings: Vec::new(),
             ctes: HashMap::new(),
             consumed_hints: HashSet::new(),
diff --git a/crates/krishiv-exec/src/planner/eval/func.rs b/crates/krishiv-exec/src/planner/eval/func.rs
index 1883c2174..70c44263d 100644
--- a/crates/krishiv-exec/src/planner/eval/func.rs
+++ b/crates/krishiv-exec/src/planner/eval/func.rs
@@ -10,12 +10,64 @@ use krishiv_functions::scalar::{Arg, BindArg, BindOptions, ScalarFunction, bind_
 use krishiv_kernels::cast::FixedOffset;
 use krishiv_kernels::map::DedupPolicy;
 use krishiv_plan::{Expr, ExprNode, ResolvedFunction};
+use krishiv_udf_sdk::ScalarUdf;
 
 use super::strings::to_view;
 use super::{Input, PhysExpr, Value, literal_array, unsupported_expr};
 use crate::error::Result;
 use crate::planner::build::{internal, unsupported};
 
+/// Binds a session UDF call: wraps the implementation (resolved from the
+/// worker by the caller) like a built-in binding, over the arguments the
+/// analyzer cast.
+pub(super) fn compile_udf(
+    udf: &Arc<dyn ScalarUdf>,
+    f: &ResolvedFunction,
+    args: Vec<Arc<dyn PhysExpr>>,
+    input: Input<'_>,
+    _e: &Expr,
+) -> Result<Arc<dyn PhysExpr>> {
+    let bind_args = f
+        .args
+        .iter()
+        .zip(&args)
+        .map(|(ir, compiled)| match &ir.node {
+            ExprNode::Literal(l) => literal_array(l).map(BindArg::Literal),
+            _ => Ok(BindArg::Column {
+                ty: compiled.data_type().clone(),
+                nullable: compiled.nullable(),
+            }),
+        })
+        .collect::<Result<Vec<_>>>()?;
+    let arg_types: Vec<ArrowType> = bind_args.iter().map(BindArg::data_type).collect();
+    // `bind_udf` reports user faults as `FAILED_EXECUTE_UDF` and engine
+    // faults as `INTERNAL_ERROR` (never `KRISHIV_UNSUPPORTED_FEATURE`,
+    // which has no planning fallback), so there is nothing to map here.
+    let function = krishiv_functions::scalar::bind_udf(
+        udf,
+        &arg_types,
+        &f.data_type,
+        f.nullable,
+        input.env.ansi,
+        input.env.zone,
+    )?;
+    let out = f.data_type.to_arrow();
+    // The binding returns plain carriers; Spark's `STRING` and `BINARY`
+    // are views here. Both derive from the analyzer's type, so they only
+    // ever match or convert to a view (by construction, no mismatch).
+    let view = matches!(
+        (function.return_type(), &out),
+        (ArrowType::Utf8, ArrowType::Utf8View) | (ArrowType::Binary, ArrowType::BinaryView)
+    );
+    Ok(Arc::new(Call {
+        function,
+        args,
+        out,
+        view,
+        nullable: f.nullable,
+    }))
+}
+
 pub(super) fn compile(
     name: &str,
     f: &ResolvedFunction,
diff --git a/crates/krishiv-exec/src/planner/eval/hof.rs b/crates/krishiv-exec/src/planner/eval/hof.rs
index 40ee604ed..b70b07df8 100644
--- a/crates/krishiv-exec/src/planner/eval/hof.rs
+++ b/crates/krishiv-exec/src/planner/eval/hof.rs
@@ -447,6 +447,7 @@ mod tests {
             kernels: KernelCtx::new(),
             query_start_micros: 0,
             user: Arc::from("test"),
+            udfs: None,
             map_key_dedup_last_win: false,
             seed_salt: Arc::new(std::sync::atomic::AtomicU64::new(0)),
         }
diff --git a/crates/krishiv-exec/src/planner/eval/mod.rs b/crates/krishiv-exec/src/planner/eval/mod.rs
index ec0e97f8c..7eee76da0 100644
--- a/crates/krishiv-exec/src/planner/eval/mod.rs
+++ b/crates/krishiv-exec/src/planner/eval/mod.rs
@@ -42,11 +42,13 @@ use arrow_schema::{DataType as ArrowType, SchemaRef};
 use krishiv_common::config::{
     ANSI_ENABLED, Config, LEGACY_STATISTICAL_AGGREGATE, MAP_KEY_DEDUP_POLICY, SESSION_TIME_ZONE,
 };
+use krishiv_common::error::{KrishivError, KrishivUdfNotAvailable};
 use krishiv_kernels::KernelCtx;
 use krishiv_plan::{
     AttrId, BoundColumn, Builtin, Expr, ExprNode, FunctionId, FunctionKind, Literal, ResolvedExpr,
     ResolvedFunction,
 };
+use krishiv_udf_sdk::UdfLibrary;
 
 use super::build::{internal, unsupported};
 use crate::error::Result;
@@ -178,6 +180,10 @@ pub(crate) struct EvalEnv {
     pub(crate) query_start_micros: i64,
     /// The session user (`current_user()`).
     pub(crate) user: Arc<str>,
+    /// The session's UDFs, resolved by (name, version) at instantiation.
+    /// Never plan data: the planner sets it from its context, and
+    /// instantiation overwrites it from the worker.
+    pub(crate) udfs: Option<Arc<UdfLibrary>>,
     /// `spark.sql.mapKeyDedupPolicy = LAST_WIN`: duplicate map keys keep
     /// the value inserted last. It travels in the plan (`ExprEnv`), so a
     /// worker instantiating a plan without the feature refuses it.
@@ -217,14 +223,16 @@ impl EvalEnv {
             kernels: KernelCtx::new(),
             query_start_micros,
             user,
+            udfs: None,
             map_key_dedup_last_win,
             seed_salt: Arc::new(AtomicU64::new(0)),
         }
     }
 
-    /// The environment a plan fixed, with this worker's kernels. Lambda
+    /// The environment a plan fixed, with this worker's kernels. UDFs are
+    /// not plan data: instantiation sets them from the worker. Lambda
     /// variables match by stable identity, so no name-resolution flag is
-    /// plan data.
+    /// plan data. The map-key dedup policy is plan data.
     pub(crate) fn from_plan(env: &ExprEnv) -> Self {
         Self {
             ansi: env.ansi,
@@ -233,6 +241,7 @@ impl EvalEnv {
             kernels: KernelCtx::new(),
             query_start_micros: env.query_start_micros,
             user: Arc::clone(&env.user),
+            udfs: None,
             map_key_dedup_last_win: env.map_key_dedup_last_win,
             seed_salt: Arc::new(AtomicU64::new(0)),
         }
@@ -332,6 +341,20 @@ pub(crate) fn compile(e: &Expr, input: Input<'_>) -> Result<Arc<dyn PhysExpr>> {
                         func::compile(name, f, args, input, e)
                     }
                 }
+                FunctionId::Udf { name, version } => {
+                    let udf = input
+                        .env
+                        .udfs
+                        .as_ref()
+                        .and_then(|lib| lib.get_versioned(name, *version))
+                        .ok_or_else(|| {
+                            KrishivError::from(KrishivUdfNotAvailable {
+                                name: name.clone(),
+                                version: version.to_string(),
+                            })
+                        })?;
+                    func::compile_udf(&udf, f, args, input, e)
+                }
                 _ => Err(unsupported_expr(e)),
             }
         }
@@ -590,10 +613,18 @@ impl ScalarExpr for Compiled {
 
 #[cfg(test)]
 mod tests {
-    use krishiv_plan::Literal;
+    use std::sync::Arc;
+
+    use arrow_schema::Schema;
+    use krishiv_common::error::ErrorClass;
+    use krishiv_plan::{FunctionId, FunctionKind, Literal};
     use krishiv_types::DataType;
+    use krishiv_udf_sdk::{
+        ArgField, InvokeContext, ReturnField, ScalarUdf, Signature, UdfArg, UdfError, UdfInputType,
+        UdfLibrary,
+    };
 
-    use super::{Lit, PhysExpr as _};
+    use super::{EvalEnv, Input, Lit, PhysExpr as _, compile};
 
     #[test]
     fn a_null_literal_is_nullable_typed_or_not() {
@@ -629,4 +660,154 @@ mod tests {
         let out = super::scatter(&BooleanArray::from(Vec::<bool>::new()), &none).unwrap();
         assert_eq!((out.len(), out.null_count()), (4, 4));
     }
+
+    /// The identity over `INT`, for the UDF compilation tests.
+    #[derive(Debug)]
+    struct Identity(u32);
+
+    impl ScalarUdf for Identity {
+        fn name(&self) -> &str {
+            "my_udf"
+        }
+
+        fn version(&self) -> u32 {
+            self.0
+        }
+
+        fn signature(&self) -> &Signature {
+            use std::sync::OnceLock;
+            static SIG: OnceLock<Signature> = OnceLock::new();
+            SIG.get_or_init(|| Signature::Exact(vec![UdfInputType::Exact(DataType::Integer)]))
+        }
+
+        fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+            Ok(ReturnField {
+                data_type: DataType::Integer,
+                nullable: true,
+            })
+        }
+
+        fn invoke(
+            &self,
+            args: &[UdfArg<'_>],
+            _: usize,
+            _: &InvokeContext,
+        ) -> Result<arrow_array::ArrayRef, UdfError> {
+            Ok(args[0].array())
+        }
+    }
+
+    fn udf_call() -> krishiv_plan::Expr {
+        use krishiv_plan::{Expr, ExprNode, ResolvedExpr, ResolvedFunction};
+        Expr::new(ExprNode::Resolved(ResolvedExpr::Function(
+            ResolvedFunction {
+                id: FunctionId::Udf {
+                    name: "my_udf".to_owned(),
+                    version: 2,
+                },
+                kind: FunctionKind::Scalar,
+                args: vec![Arc::new(Expr::literal(Literal::Integer(1)))],
+                distinct: false,
+                filter: None,
+                data_type: DataType::Integer,
+                nullable: true,
+                deterministic: true,
+            },
+        )))
+    }
+
+    fn env_with(udfs: Option<Arc<UdfLibrary>>) -> EvalEnv {
+        EvalEnv {
+            ansi: true,
+            legacy_statistical_aggregate: false,
+            zone: None,
+            kernels: krishiv_kernels::KernelCtx::new(),
+            query_start_micros: 0,
+            user: Arc::from("test"),
+            udfs,
+            map_key_dedup_last_win: false,
+            seed_salt: Arc::new(std::sync::atomic::AtomicU64::new(0)),
+        }
+    }
+
+    /// Compiling a UDF call without the UDF on the executing side fails
+    /// with `KRISHIV_UDF_NOT_AVAILABLE`, naming `name@version`.
+    #[test]
+    fn a_missing_udf_fails_compilation_naming_name_and_version() {
+        let schema = Arc::new(Schema::empty());
+        let e = udf_call();
+        for udfs in [None, Some(Arc::new(UdfLibrary::new()))] {
+            let env = env_with(udfs);
+            let input = Input {
+                layout: &[],
+                schema: &schema,
+                env: &env,
+                subqueries: &[],
+            };
+            let err = compile(&e, input).unwrap_err();
+            assert_eq!(err.error_class(), ErrorClass::KrishivUdfNotAvailable);
+            assert!(err.to_string().contains("my_udf@2"), "{err}");
+        }
+        // A library holding another version is the same failure: the
+        // plan names `my_udf@2`.
+        let other = Arc::new(UdfLibrary::new());
+        other.register(Arc::new(Identity(9))).unwrap();
+        let env = env_with(Some(other));
+        let input = Input {
+            layout: &[],
+            schema: &schema,
+            env: &env,
+            subqueries: &[],
+        };
+        let err = compile(&e, input).unwrap_err();
+        assert_eq!(err.error_class(), ErrorClass::KrishivUdfNotAvailable);
+        assert!(err.to_string().contains("my_udf@2"), "{err}");
+    }
+
+    /// Compiling a UDF call with its version present binds it.
+    #[test]
+    fn a_registered_udf_binds_where_the_analyzer_typed_it() {
+        let lib = Arc::new(UdfLibrary::new());
+        lib.register(Arc::new(Identity(2))).unwrap();
+        let env = env_with(Some(lib));
+        let schema = Arc::new(Schema::empty());
+        let e = udf_call();
+        let input = Input {
+            layout: &[],
+            schema: &schema,
+            env: &env,
+            subqueries: &[],
+        };
+        let compiled = compile(&e, input).unwrap();
+        assert_eq!(compiled.data_type(), &arrow_schema::DataType::Int32);
+    }
+
+    /// The fixture exposes its declared contract directly.
+    #[test]
+    fn udf_fixture_exposes_its_contract() {
+        let udf = Identity(2);
+        assert_eq!(udf.name(), "my_udf");
+        assert_eq!(udf.version(), 2);
+        assert_eq!(
+            udf.signature(),
+            &Signature::Exact(vec![UdfInputType::Exact(DataType::Integer)])
+        );
+        let field = udf.return_field(&[]).unwrap();
+        assert_eq!(field.data_type, DataType::Integer);
+        assert!(field.nullable);
+        let array: arrow_array::ArrayRef =
+            std::sync::Arc::new(arrow_array::Int32Array::from(vec![1]));
+        let out = udf
+            .invoke(
+                &[UdfArg::Column(&array)],
+                1,
+                &InvokeContext {
+                    partition: 0,
+                    ansi: true,
+                    time_zone: None,
+                },
+            )
+            .unwrap();
+        assert_eq!(out.len(), 1);
+    }
 }
diff --git a/crates/krishiv-exec/src/planner/mod.rs b/crates/krishiv-exec/src/planner/mod.rs
index 807e590f3..c81254c28 100644
--- a/crates/krishiv-exec/src/planner/mod.rs
+++ b/crates/krishiv-exec/src/planner/mod.rs
@@ -45,6 +45,7 @@ use std::sync::Arc;
 
 use krishiv_common::config::Config;
 use krishiv_plan::Plan;
+use krishiv_udf_sdk::UdfLibrary;
 
 pub use build::DefaultPlanner;
 pub(crate) use build::concat_schemas;
@@ -82,6 +83,10 @@ pub struct PlanningContext {
     pub config: Arc<Config>,
     /// The session's user (`current_user()`).
     pub user: Arc<str>,
+    /// The session's UDFs, for validating UDF calls at planning. The
+    /// implementation a plan runs is resolved from the worker at
+    /// instantiation, never stored in the plan.
+    pub udfs: Option<Arc<UdfLibrary>>,
 }
 
 impl PlanningContext {
@@ -91,6 +96,7 @@ impl PlanningContext {
             tables,
             config,
             user: Arc::from(krishiv_plan::analyzer::Principal::local_user().name),
+            udfs: None,
         }
     }
 
@@ -100,6 +106,13 @@ impl PlanningContext {
         self.user = user.into();
         self
     }
+
+    /// The same context validating UDF calls against `udfs`.
+    #[must_use]
+    pub fn with_udfs(mut self, udfs: Arc<UdfLibrary>) -> Self {
+        self.udfs = Some(udfs);
+        self
+    }
 }
 
 impl fmt::Debug for PlanningContext {
diff --git a/crates/krishiv-functions/Cargo.toml b/crates/krishiv-functions/Cargo.toml
index 53b1a747c..76b3b23d7 100644
--- a/crates/krishiv-functions/Cargo.toml
+++ b/crates/krishiv-functions/Cargo.toml
@@ -10,6 +10,7 @@ publish = false
 
 [dependencies]
 arrow-array.workspace = true
+arrow-buffer.workspace = true
 arrow-schema.workspace = true
 arrow-select.workspace = true
 fancy-regex = { workspace = true, features = ["std"] }
@@ -28,6 +29,7 @@ regex-syntax = { workspace = true, features = ["unicode-bool", "unicode-case", "
 krishiv-common = { path = "../krishiv-common" }
 krishiv-kernels = { path = "../krishiv-kernels" }
 krishiv-types = { path = "../krishiv-types" }
+krishiv-udf-sdk = { path = "../krishiv-udf-sdk" }
 
 [package.metadata.cargo-machete]
 ignored = ["regex-automata", "regex-syntax"]
diff --git a/crates/krishiv-functions/src/scalar/mod.rs b/crates/krishiv-functions/src/scalar/mod.rs
index b6ee458fb..a7f47ea71 100644
--- a/crates/krishiv-functions/src/scalar/mod.rs
+++ b/crates/krishiv-functions/src/scalar/mod.rs
@@ -41,6 +41,7 @@ mod regex;
 mod session;
 mod string;
 mod r#struct;
+mod udf;
 mod url;
 
 pub use regex::{extract_all_pieces, split_regex};
@@ -58,6 +59,7 @@ use krishiv_kernels::map::DedupPolicy;
 
 pub use args::Arg;
 use args::{Inputs, broadcast, internal, unsupported};
+pub use udf::{bind_udf, failed_execute};
 
 /// An argument as the planner knows it when binding.
 #[derive(Debug, Clone)]
diff --git a/crates/krishiv-functions/src/scalar/udf.rs b/crates/krishiv-functions/src/scalar/udf.rs
new file mode 100644
index 000000000..e93dd6106
--- /dev/null
+++ b/crates/krishiv-functions/src/scalar/udf.rs
@@ -0,0 +1,969 @@
+// SPDX-License-Identifier: Apache-2.0
+//! The execution binding of session UDFs: [`bind_udf`] turns a
+//! [`ScalarUdf`](krishiv_udf_sdk::ScalarUdf) and its bound argument types
+//! into a [`ScalarFunction`] the physical planner calls once per batch.
+//!
+//! The wrapper mirrors [`Bound`](super::Bound): it checks the
+//! invocation against the binding (argument count and types), computes one
+//! row and broadcasts it when every argument is a literal, and checks the
+//! result's length, type and nullability. Where it differs is the contract
+//! with user code: every user error, contract break or panic becomes
+//! Spark's `FAILED_EXECUTE_UDF` (SQLSTATE 39000), and a
+//! [`Strict`](krishiv_udf_sdk::NullHandling::Strict) UDF never sees a null
+//! row (null inputs give null without invoking, as Spark's strict
+//! functions do).
+
+use std::sync::Arc;
+
+use arrow_array::{Array, ArrayRef, UInt32Array, new_null_array};
+use arrow_buffer::BooleanBuffer;
+use arrow_schema::DataType as ArrowType;
+use krishiv_common::error::{FailedExecuteUdf, KrishivError};
+use krishiv_types::DataType;
+use krishiv_udf_sdk::guard_call;
+
+use super::ScalarFunction;
+use super::args::{Arg, broadcast, internal};
+
+/// Binds the session UDF `udf` to `args` (the bound Arrow type of each
+/// argument, in order): what the evaluator calls per batch.
+///
+/// `data_type` and `nullable` are the result the analyzer typed for the
+/// same call (from [`ScalarUdf::return_field`](krishiv_udf_sdk::ScalarUdf::return_field)
+/// over the same argument types); the wrapper checks every result against
+/// them. `ansi` and `time_zone` reach the UDF in its
+/// [`InvokeContext`](krishiv_udf_sdk::InvokeContext).
+///
+/// # Errors
+/// `INTERNAL_ERROR` for an arity the UDF's signature does not take (the
+/// analyzer checked it for the same version, so this is an engine bug).
+pub fn bind_udf(
+    udf: &Arc<dyn krishiv_udf_sdk::ScalarUdf>,
+    args: &[ArrowType],
+    data_type: &DataType,
+    nullable: bool,
+    ansi: bool,
+    time_zone: Option<i32>,
+) -> Result<Arc<dyn ScalarFunction>, KrishivError> {
+    // Every trait call goes through `guard_call`: a panicking UDF becomes
+    // `FAILED_EXECUTE_UDF`, never an unwinding engine.
+    let name = match guard_call("unknown", "name", || udf.name().to_owned()) {
+        Ok(n) => n.to_lowercase(),
+        Err(e) => {
+            return Err(failed_execute("unknown", "unknown", "unknown", e.message()));
+        }
+    };
+    let version = match guard_call(&name, "version", || udf.version()) {
+        Ok(v) => v,
+        Err(e) => {
+            return Err(failed_execute(&name, "unknown", "unknown", e.message()));
+        }
+    };
+    let signature = match guard_call(&name, "signature", || udf.signature().clone()) {
+        Ok(s) => s,
+        Err(e) => {
+            return Err(failed_execute(&name, "unknown", "unknown", e.message()));
+        }
+    };
+    if !signature.accepts(args.len()) {
+        return Err(internal(format!(
+            "udf {name} bound to {} arguments",
+            args.len()
+        )));
+    }
+    let signature_sql = signature.inputs_sql();
+    let strict = match guard_call(&name, "properties", || udf.properties()) {
+        Ok(p) => matches!(p.null_handling, krishiv_udf_sdk::NullHandling::Strict),
+        Err(e) => {
+            return Err(failed_execute(
+                &name,
+                &signature_sql,
+                "unknown",
+                e.message(),
+            ));
+        }
+    };
+    let _ = version;
+    Ok(Arc::new(UdfBound {
+        udf: Arc::clone(udf),
+        name,
+        version,
+        signature_sql,
+        args: args.to_vec(),
+        return_type: plain_carrier(data_type),
+        nullable,
+        strict,
+        ansi,
+        time_zone,
+    }))
+}
+
+/// `FAILED_EXECUTE_UDF` for `name` (`signature` => `result`) and `reason`.
+pub fn failed_execute(name: &str, signature: &str, result: &str, reason: &str) -> KrishivError {
+    KrishivError::from(FailedExecuteUdf {
+        function_name: name.to_owned(),
+        signature: signature.to_owned(),
+        result: result.to_owned(),
+        reason: reason.to_owned(),
+    })
+}
+
+/// The plain Arrow carrier of `t`: what UDFs return (`Utf8` for `STRING`,
+/// `Binary` for `BINARY`, the canonical type otherwise). The evaluator
+/// converts strings and binaries to views itself, as for built-ins.
+fn plain_carrier(t: &DataType) -> ArrowType {
+    match t {
+        DataType::String => ArrowType::Utf8,
+        DataType::Binary => ArrowType::Binary,
+        _ => t.to_arrow(),
+    }
+}
+
+/// A bound session UDF over its argument types: what the evaluator calls
+/// per batch.
+struct UdfBound {
+    udf: Arc<dyn krishiv_udf_sdk::ScalarUdf>,
+    name: String,
+    version: u32,
+    signature_sql: String,
+    args: Vec<ArrowType>,
+    return_type: ArrowType,
+    nullable: bool,
+    strict: bool,
+    ansi: bool,
+    time_zone: Option<i32>,
+}
+
+impl std::fmt::Debug for UdfBound {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("UdfFunction")
+            .field("name", &self.name)
+            .field("version", &self.version)
+            .field("args", &self.args)
+            .field("return_type", &self.return_type)
+            .finish_non_exhaustive()
+    }
+}
+
+impl ScalarFunction for UdfBound {
+    fn name(&self) -> &str {
+        &self.name
+    }
+
+    fn return_type(&self) -> &ArrowType {
+        &self.return_type
+    }
+
+    fn invoke(&self, args: &[Arg], rows: usize) -> Result<ArrayRef, KrishivError> {
+        if args.len() != self.args.len() {
+            return Err(internal(format!(
+                "{} bound to {} arguments called with {}",
+                self.name,
+                self.args.len(),
+                args.len()
+            )));
+        }
+        for (a, t) in args.iter().zip(&self.args) {
+            a.check(t, rows, &self.name)?;
+        }
+        // No rows: nothing is computed, so nothing raises.
+        if rows == 0 {
+            return Ok(new_null_array(&self.return_type, 0));
+        }
+        let strict = self.strict.then(|| strict_mask(args));
+        // A null in every row: null without invoking, so a strict UDF
+        // never sees a null (a null literal is every row). Narrowed so the
+        // match below needs no second `AllNull` arm.
+        enum Narrow {
+            None,
+            Some(BooleanBuffer),
+        }
+        let strict: Option<Narrow> = match strict {
+            Some(Strict::AllNull) => return Ok(new_null_array(&self.return_type, rows)),
+            Some(Strict::None) => Some(Narrow::None),
+            Some(Strict::Some(valid)) => Some(Narrow::Some(valid)),
+            None => None,
+        };
+        // Every argument a literal: compute one row, then repeat it.
+        if args.iter().all(|a| matches!(a, Arg::Scalar(_))) {
+            let out = self.invoke_udf(args, 1)?;
+            self.check(&out, 1)?;
+            if rows == 1 {
+                return Ok(out);
+            }
+            return broadcast(&out, rows).map_err(|e| internal(e.to_string()));
+        }
+        match strict {
+            // No nulls (or not strict): invoke over the batch.
+            Some(Narrow::None) | None => {
+                let out = self.invoke_udf(args, rows)?;
+                self.check(&out, rows)?;
+                Ok(out)
+            }
+            // Some nulls: invoke over the non-null rows, scatter back.
+            Some(Narrow::Some(valid)) => {
+                let kept: Vec<usize> = valid
+                    .iter()
+                    .enumerate()
+                    .filter(|(_, v)| *v)
+                    .map(|(i, _)| i)
+                    .collect();
+                let compacted: Vec<Arg> = args
+                    .iter()
+                    .map(|a| match a {
+                        Arg::Scalar(one) => Ok(Arg::Scalar(Arc::clone(one))),
+                        Arg::Array(column) => take(column, &kept).map(Arg::Array),
+                    })
+                    .collect::<Result<_, _>>()?;
+                let compacted_udf: Vec<krishiv_udf_sdk::UdfArg<'_>> =
+                    compacted.iter().map(arg_of).collect();
+                let out = self.call(&compacted_udf, kept.len())?;
+                self.check(&out, kept.len())?;
+                scatter(&out, &valid)
+            }
+        }
+    }
+}
+
+/// The null mask of `args` over `rows` rows: every row null, none, or some.
+enum Strict {
+    AllNull,
+    None,
+    Some(BooleanBuffer),
+}
+
+/// The union of the null masks of `args`: a scalar null is every row null.
+/// Validity comes from `logical_nulls`, so a logical null (an untyped
+/// `NULL` literal's `NullArray`, a dictionary or a run-end array) counts
+/// as null too.
+fn strict_mask(args: &[Arg]) -> Strict {
+    let mut valid: Option<BooleanBuffer> = None;
+    for a in args {
+        match a {
+            Arg::Scalar(one) if one.logical_nulls().is_some_and(|n| n.is_null(0)) => {
+                return Strict::AllNull;
+            }
+            Arg::Scalar(_) => {}
+            Arg::Array(column) => {
+                let Some(nulls) = column.logical_nulls() else {
+                    continue;
+                };
+                // A validity buffer over the whole batch.
+                let column_valid = nulls.inner().clone();
+                valid = Some(match valid {
+                    None => column_valid,
+                    Some(have) => &have & &column_valid,
+                });
+            }
+        }
+    }
+    let Some(valid) = valid else {
+        return Strict::None;
+    };
+    if valid.count_set_bits() == 0 {
+        Strict::AllNull
+    } else if valid.len() == valid.count_set_bits() {
+        Strict::None
+    } else {
+        Strict::Some(valid)
+    }
+}
+
+/// `a` as a UDF argument.
+fn arg_of(a: &Arg) -> krishiv_udf_sdk::UdfArg<'_> {
+    match a {
+        Arg::Array(column) => krishiv_udf_sdk::UdfArg::Column(column),
+        Arg::Scalar(one) => krishiv_udf_sdk::UdfArg::Scalar(one),
+    }
+}
+
+impl UdfBound {
+    /// Invokes the UDF over `args` (each a column of `rows` values or a
+    /// one-row literal), catching panics. Every user error or panic is
+    /// `FAILED_EXECUTE_UDF`.
+    fn invoke_udf(&self, args: &[Arg], rows: usize) -> Result<ArrayRef, KrishivError> {
+        let udf_args: Vec<krishiv_udf_sdk::UdfArg<'_>> = args.iter().map(arg_of).collect();
+        self.call(&udf_args, rows)
+    }
+
+    /// Calls the UDF implementation through `guard_call`: every user error
+    /// or panic is `FAILED_EXECUTE_UDF`.
+    fn call(
+        &self,
+        args: &[krishiv_udf_sdk::UdfArg<'_>],
+        rows: usize,
+    ) -> Result<ArrayRef, KrishivError> {
+        let ctx = krishiv_udf_sdk::InvokeContext {
+            partition: 0,
+            ansi: self.ansi,
+            time_zone: self.time_zone,
+        };
+        let udf = Arc::clone(&self.udf);
+        let name = self.name.clone();
+        match guard_call(&name, "invoke", || udf.invoke(args, rows, &ctx)) {
+            Ok(Ok(out)) => Ok(out),
+            Ok(Err(e)) | Err(e) => Err(self.execute(e.message().to_owned())),
+        }
+    }
+
+    /// Checks the UDF's result: `rows` values of the declared type, and no
+    /// nulls when the call is declared non-nullable. A break is the UDF's
+    /// fault, so `FAILED_EXECUTE_UDF`, never silent.
+    fn check(&self, out: &ArrayRef, rows: usize) -> Result<(), KrishivError> {
+        if out.len() != rows || out.data_type() != &self.return_type {
+            return Err(self.execute(format!(
+                "returned {} rows of {} for {rows} rows of {}",
+                out.len(),
+                out.data_type(),
+                self.return_type
+            )));
+        }
+        if !self.nullable && out.null_count() > 0 {
+            return Err(self.execute(format!(
+                "returned {} nulls but is declared non-nullable",
+                out.null_count()
+            )));
+        }
+        Ok(())
+    }
+
+    /// `FAILED_EXECUTE_UDF` for this call and `reason`.
+    fn execute(&self, reason: String) -> KrishivError {
+        FailedExecuteUdf {
+            function_name: self.name.clone(),
+            signature: self.signature_sql.clone(),
+            result: self.udf_return_sql(),
+            reason,
+        }
+        .into()
+    }
+
+    /// The declared result type as Spark prints it.
+    fn udf_return_sql(&self) -> String {
+        // The declared Arrow carrier inverts to the declared Spark type.
+        DataType::from_arrow(&self.return_type)
+            .map(|t| t.sql())
+            .unwrap_or_else(|_| self.return_type.to_string())
+    }
+}
+
+/// `column` at `kept`, in order.
+fn take(column: &ArrayRef, kept: &[usize]) -> Result<ArrayRef, KrishivError> {
+    let indices: UInt32Array = kept
+        .iter()
+        .map(|i| u32::try_from(*i).map_err(|_| internal("a batch too large to mask".to_owned())))
+        .collect::<Result<_, _>>()?;
+    arrow_select::take::take(column.as_ref(), &indices, None).map_err(|e| internal(e.to_string()))
+}
+
+/// `values` (one per set bit of `valid`, in order) spread over its rows,
+/// NULL where `valid` is unset.
+fn scatter(values: &ArrayRef, valid: &BooleanBuffer) -> Result<ArrayRef, KrishivError> {
+    if values.len() != valid.count_set_bits() {
+        return Err(internal(
+            "a UDF over masked rows returned the wrong row count".to_owned(),
+        ));
+    }
+    let mut next = 0_u32;
+    let indices: Vec<Option<u32>> = valid
+        .iter()
+        .map(|keep| {
+            keep.then(|| {
+                let at = next;
+                next += 1;
+                at
+            })
+        })
+        .collect();
+    if usize::try_from(next).ok() != Some(values.len()) {
+        return Err(internal(
+            "a UDF over masked rows returned the wrong row count".to_owned(),
+        ));
+    }
+    let indices = UInt32Array::from_iter(indices);
+    arrow_select::take::take(values.as_ref(), &indices, None).map_err(|e| internal(e.to_string()))
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::Mutex;
+    use std::sync::PoisonError;
+
+    use arrow_array::{Int32Array, StringArray};
+    use krishiv_common::error::ErrorClass;
+    use krishiv_types::DataType;
+    use krishiv_udf_sdk::{
+        ArgField, InvokeContext, NullHandling, ReturnField, ScalarUdf, Signature, UdfArg, UdfError,
+        UdfInputType, UdfProperties,
+    };
+
+    use super::*;
+
+    fn int_arg(values: Vec<Option<i32>>) -> ArrayRef {
+        Arc::new(Int32Array::from(values))
+    }
+
+    fn lit_arg(value: i32) -> ArrayRef {
+        Arc::new(Int32Array::from(vec![value]))
+    }
+
+    fn int_sig() -> Signature {
+        Signature::Exact(vec![UdfInputType::Exact(DataType::Integer)])
+    }
+
+    #[derive(Debug, Default)]
+    struct Calls {
+        invocations: usize,
+        rows: Vec<usize>,
+    }
+
+    /// Copies its integer argument, recording invocations.
+    #[derive(Debug)]
+    struct Identity {
+        calls: Mutex<Calls>,
+        signature: Signature,
+        nullable: bool,
+        strict: bool,
+    }
+
+    impl Identity {
+        fn new(signature: Signature, nullable: bool, strict: bool) -> Self {
+            Self {
+                calls: Mutex::new(Calls::default()),
+                signature,
+                nullable,
+                strict,
+            }
+        }
+    }
+
+    impl ScalarUdf for Identity {
+        fn name(&self) -> &str {
+            "identity_i32"
+        }
+
+        fn version(&self) -> u32 {
+            3
+        }
+
+        fn signature(&self) -> &Signature {
+            &self.signature
+        }
+
+        fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+            Ok(ReturnField {
+                data_type: DataType::Integer,
+                nullable: self.nullable,
+            })
+        }
+
+        fn properties(&self) -> UdfProperties {
+            UdfProperties {
+                deterministic: true,
+                null_handling: if self.strict {
+                    NullHandling::Strict
+                } else {
+                    NullHandling::Custom
+                },
+            }
+        }
+
+        fn invoke(
+            &self,
+            args: &[UdfArg<'_>],
+            rows: usize,
+            _: &InvokeContext,
+        ) -> Result<ArrayRef, UdfError> {
+            let mut calls = self.calls.lock().unwrap_or_else(PoisonError::into_inner);
+            calls.invocations += 1;
+            calls.rows.push(rows);
+            let input = args[0].array();
+            let input = input
+                .as_any()
+                .downcast_ref::<Int32Array>()
+                .ok_or_else(|| UdfError::new("identity_i32 needs INT"))?;
+            assert_eq!(
+                input.len(),
+                if matches!(args[0], UdfArg::Scalar(_)) {
+                    1
+                } else {
+                    rows
+                }
+            );
+            Ok(Arc::new(input.clone()))
+        }
+    }
+
+    fn bind(udf: &Arc<dyn krishiv_udf_sdk::ScalarUdf>, nullable: bool) -> Arc<dyn ScalarFunction> {
+        bind_udf(
+            udf,
+            &[ArrowType::Int32],
+            &DataType::Integer,
+            nullable,
+            true,
+            Some(0),
+        )
+        .unwrap()
+    }
+
+    #[test]
+    fn columns_invoke_once_per_batch() {
+        let udf: Arc<dyn krishiv_udf_sdk::ScalarUdf> =
+            Arc::new(Identity::new(int_sig(), true, true));
+        let bound = bind(&udf, true);
+        assert_eq!(bound.name(), "identity_i32");
+        assert_eq!(bound.return_type(), &ArrowType::Int32);
+        let out = bound
+            .invoke(&[Arg::Array(int_arg(vec![Some(1), None, Some(3)]))], 3)
+            .unwrap();
+        // Strict: the null row is null without invoking over it.
+        let out = out.as_any().downcast_ref::<Int32Array>().unwrap();
+        assert_eq!(out.len(), 3);
+        assert_eq!((out.value(0), out.is_null(1), out.value(2)), (1, true, 3));
+    }
+
+    #[test]
+    fn all_null_strict_never_invokes() {
+        let inner = Arc::new(Identity::new(int_sig(), true, true));
+        let udf = Arc::clone(&inner) as Arc<dyn krishiv_udf_sdk::ScalarUdf>;
+        let bound = bind(&udf, true);
+        let out = bound
+            .invoke(&[Arg::Array(int_arg(vec![None, None]))], 2)
+            .unwrap();
+        assert_eq!(out.null_count(), 2);
+        // A null literal is every row null, also for all-literal calls.
+        let out = bound
+            .invoke(
+                &[Arg::Scalar(Arc::new(new_null_array(
+                    &arrow_schema::DataType::Int32,
+                    1,
+                )))],
+                2,
+            )
+            .unwrap();
+        assert_eq!(out.null_count(), 2);
+        // Neither path invoked the UDF.
+        assert_eq!(
+            inner
+                .calls
+                .lock()
+                .unwrap_or_else(PoisonError::into_inner)
+                .invocations,
+            0
+        );
+    }
+
+    #[test]
+    fn all_scalar_broadcasts_one_row() {
+        let inner = Arc::new(Identity::new(int_sig(), true, true));
+        let udf = Arc::clone(&inner) as Arc<dyn krishiv_udf_sdk::ScalarUdf>;
+        let bound = bind(&udf, true);
+        let out = bound.invoke(&[Arg::Scalar(lit_arg(7))], 4).unwrap();
+        let out = out.as_any().downcast_ref::<Int32Array>().unwrap();
+        assert_eq!(out.values(), &[7, 7, 7, 7]);
+        let calls = inner.calls.lock().unwrap_or_else(PoisonError::into_inner);
+        assert_eq!(
+            (calls.invocations, calls.rows.as_slice()),
+            (1, [1].as_slice())
+        );
+    }
+
+    #[test]
+    fn custom_nulls_reach_the_udf() {
+        let udf: Arc<dyn krishiv_udf_sdk::ScalarUdf> =
+            Arc::new(Identity::new(int_sig(), true, false));
+        let bound = bind(&udf, true);
+        let out = bound
+            .invoke(&[Arg::Array(int_arg(vec![Some(1), None]))], 2)
+            .unwrap();
+        // The identity copies the null through itself.
+        assert_eq!(out.null_count(), 1);
+    }
+
+    #[test]
+    fn empty_batches_invoke_nothing() {
+        let udf: Arc<dyn krishiv_udf_sdk::ScalarUdf> =
+            Arc::new(Identity::new(int_sig(), true, true));
+        let bound = bind(&udf, true);
+        let out = bound.invoke(&[Arg::Array(int_arg(vec![]))], 0).unwrap();
+        assert_eq!(out.len(), 0);
+    }
+
+    #[test]
+    fn arity_mismatches_are_internal() {
+        let udf: Arc<dyn krishiv_udf_sdk::ScalarUdf> =
+            Arc::new(Identity::new(int_sig(), true, true));
+        assert!(bind_udf(&udf, &[], &DataType::Integer, true, true, Some(0)).is_err());
+        let bound = bind(&udf, true);
+        assert_eq!(
+            bound.invoke(&[], 1).unwrap_err().error_class(),
+            ErrorClass::InternalError
+        );
+        assert_eq!(
+            bound
+                .invoke(&[Arg::Scalar(lit_arg(1)), Arg::Scalar(lit_arg(2))], 1)
+                .unwrap_err()
+                .error_class(),
+            ErrorClass::InternalError
+        );
+    }
+
+    #[derive(Debug)]
+    struct Broken {
+        what: &'static str,
+    }
+
+    impl ScalarUdf for Broken {
+        fn name(&self) -> &str {
+            "broken"
+        }
+
+        fn version(&self) -> u32 {
+            1
+        }
+
+        fn signature(&self) -> &Signature {
+            use std::sync::OnceLock;
+            static SIG: OnceLock<Signature> = OnceLock::new();
+            SIG.get_or_init(|| Signature::Exact(vec![UdfInputType::Exact(DataType::Integer)]))
+        }
+
+        fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+            Ok(ReturnField {
+                data_type: DataType::Integer,
+                nullable: false,
+            })
+        }
+
+        fn invoke(
+            &self,
+            args: &[UdfArg<'_>],
+            rows: usize,
+            _: &InvokeContext,
+        ) -> Result<ArrayRef, UdfError> {
+            match self.what {
+                "type" => Ok(Arc::new(StringArray::from(vec!["x"; rows]))),
+                "length" => Ok(int_arg(vec![Some(1)])),
+                "null" => Ok(int_arg(vec![None; rows])),
+                "error" => Err(UdfError::new("nope")),
+                "panic" => panic!("boom"),
+                "message" => Err(UdfError::from("detailed reason")),
+                _ => {
+                    let input = args[0].array();
+                    Ok(input)
+                }
+            }
+        }
+    }
+
+    fn broken(what: &'static str) -> Arc<dyn ScalarFunction> {
+        let udf: Arc<dyn krishiv_udf_sdk::ScalarUdf> = Arc::new(Broken { what });
+        bind_udf(
+            &udf,
+            &[ArrowType::Int32],
+            &DataType::Integer,
+            false,
+            true,
+            Some(0),
+        )
+        .unwrap()
+    }
+
+    fn invoke(bound: &Arc<dyn ScalarFunction>, rows: usize) -> Result<ArrayRef, KrishivError> {
+        bound.invoke(&[Arg::Array(int_arg(vec![Some(1); rows]))], rows)
+    }
+
+    #[test]
+    fn contract_breaks_fail_as_failed_execute_udf() {
+        for what in ["type", "length", "null"] {
+            let err = invoke(&broken(what), 3).unwrap_err();
+            assert_eq!(err.error_class(), ErrorClass::FailedExecuteUdf, "{what}");
+            assert!(err.to_string().contains("broken"), "{what}: {err}");
+        }
+    }
+
+    #[test]
+    fn user_errors_and_panics_fail_as_failed_execute_udf() {
+        for what in ["error", "panic"] {
+            let err = invoke(&broken(what), 2).unwrap_err();
+            assert_eq!(err.error_class(), ErrorClass::FailedExecuteUdf, "{what}");
+            assert!(err.to_string().contains("broken"), "{what}: {err}");
+        }
+        let err = invoke(&broken("message"), 2).unwrap_err();
+        assert!(err.to_string().contains("detailed reason"), "{err}");
+        let err = invoke(&broken("panic"), 2).unwrap_err();
+        assert!(err.to_string().contains("boom"), "{err}");
+    }
+
+    #[test]
+    fn failed_execute_udf_names_signature_and_result() {
+        let udf: Arc<dyn krishiv_udf_sdk::ScalarUdf> = Arc::new(Broken { what: "error" });
+        let bound = bind_udf(
+            &udf,
+            &[ArrowType::Int32],
+            &DataType::Integer,
+            true,
+            true,
+            Some(0),
+        )
+        .unwrap();
+        let err = invoke(&bound, 1).unwrap_err();
+        let text = err.to_string();
+        assert!(text.contains("broken"), "{text}");
+        assert!(text.contains("\"INT\""), "{text}");
+        assert!(text.contains("nope"), "{text}");
+    }
+
+    #[derive(Debug)]
+    struct PanicMeta {
+        what: &'static str,
+    }
+
+    impl ScalarUdf for PanicMeta {
+        fn name(&self) -> &str {
+            "panic_meta"
+        }
+
+        fn version(&self) -> u32 {
+            1
+        }
+
+        fn signature(&self) -> &Signature {
+            if self.what == "signature" {
+                panic!("signature went bang");
+            }
+            use std::sync::OnceLock;
+            static SIG: OnceLock<Signature> = OnceLock::new();
+            SIG.get_or_init(|| Signature::Exact(vec![UdfInputType::Exact(DataType::Integer)]))
+        }
+
+        fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+            Ok(ReturnField {
+                data_type: DataType::Integer,
+                nullable: true,
+            })
+        }
+
+        fn properties(&self) -> UdfProperties {
+            if self.what == "properties" {
+                panic!("properties went bang");
+            }
+            UdfProperties::default()
+        }
+
+        fn invoke(
+            &self,
+            args: &[UdfArg<'_>],
+            _: usize,
+            _: &InvokeContext,
+        ) -> Result<ArrayRef, UdfError> {
+            Ok(args[0].array())
+        }
+    }
+
+    #[test]
+    fn panicking_signature_and_properties_become_failed_execute_udf() {
+        for what in ["signature", "properties"] {
+            let udf: Arc<dyn krishiv_udf_sdk::ScalarUdf> = Arc::new(PanicMeta { what });
+            let err = bind_udf(
+                &udf,
+                &[ArrowType::Int32],
+                &DataType::Integer,
+                true,
+                true,
+                Some(0),
+            )
+            .unwrap_err();
+            assert_eq!(err.error_class(), ErrorClass::FailedExecuteUdf, "{what}");
+            assert!(err.to_string().contains("went bang"), "{what}: {err}");
+            assert!(err.to_string().contains("panic_meta"), "{what}: {err}");
+        }
+    }
+
+    #[derive(Debug)]
+    struct PanicName;
+    impl ScalarUdf for PanicName {
+        fn name(&self) -> &str {
+            panic!("name went bang")
+        }
+        fn version(&self) -> u32 {
+            1
+        }
+        fn signature(&self) -> &Signature {
+            use std::sync::OnceLock;
+            static SIG: OnceLock<Signature> = OnceLock::new();
+            SIG.get_or_init(|| Signature::Exact(vec![UdfInputType::Exact(DataType::Integer)]))
+        }
+        fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+            Ok(ReturnField {
+                data_type: DataType::Integer,
+                nullable: true,
+            })
+        }
+        fn invoke(
+            &self,
+            args: &[UdfArg<'_>],
+            _: usize,
+            _: &InvokeContext,
+        ) -> Result<ArrayRef, UdfError> {
+            Ok(args[0].array())
+        }
+    }
+
+    #[derive(Debug)]
+    struct PanicVersion;
+    impl ScalarUdf for PanicVersion {
+        fn name(&self) -> &str {
+            "panic_version"
+        }
+        fn version(&self) -> u32 {
+            panic!("version went bang")
+        }
+        fn signature(&self) -> &Signature {
+            use std::sync::OnceLock;
+            static SIG: OnceLock<Signature> = OnceLock::new();
+            SIG.get_or_init(|| Signature::Exact(vec![UdfInputType::Exact(DataType::Integer)]))
+        }
+        fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+            Ok(ReturnField {
+                data_type: DataType::Integer,
+                nullable: true,
+            })
+        }
+        fn invoke(
+            &self,
+            args: &[UdfArg<'_>],
+            _: usize,
+            _: &InvokeContext,
+        ) -> Result<ArrayRef, UdfError> {
+            Ok(args[0].array())
+        }
+    }
+
+    #[test]
+    fn panicking_name_and_version_become_failed_execute_udf() {
+        let udf: Arc<dyn krishiv_udf_sdk::ScalarUdf> = Arc::new(PanicName);
+        let err = bind_udf(
+            &udf,
+            &[ArrowType::Int32],
+            &DataType::Integer,
+            true,
+            true,
+            Some(0),
+        )
+        .unwrap_err();
+        assert_eq!(err.error_class(), ErrorClass::FailedExecuteUdf);
+        assert!(err.to_string().contains("name went bang"), "{err}");
+        assert!(err.to_string().contains("unknown"), "{err}");
+        let udf: Arc<dyn krishiv_udf_sdk::ScalarUdf> = Arc::new(PanicVersion);
+        let err = bind_udf(
+            &udf,
+            &[ArrowType::Int32],
+            &DataType::Integer,
+            true,
+            true,
+            Some(0),
+        )
+        .unwrap_err();
+        assert_eq!(err.error_class(), ErrorClass::FailedExecuteUdf);
+        assert!(err.to_string().contains("version went bang"), "{err}");
+        assert!(err.to_string().contains("panic_version"), "{err}");
+    }
+
+    #[test]
+    fn binary_and_string_bind_to_plain_carriers() {
+        // BINARY binds to the plain Binary carrier (views convert at eval).
+        let udf: Arc<dyn krishiv_udf_sdk::ScalarUdf> =
+            Arc::new(Identity::new(int_sig(), true, true));
+        let bound = bind_udf(
+            &udf,
+            &[ArrowType::Int32],
+            &DataType::Binary,
+            true,
+            true,
+            Some(0),
+        )
+        .unwrap();
+        assert_eq!(bound.return_type(), &ArrowType::Binary);
+        assert_eq!(format!("{bound:?}"), format!("{bound:?}"));
+        let debug = format!("{bound:?}");
+        assert!(debug.contains("UdfFunction"), "{debug}");
+        assert!(debug.contains("identity_i32"), "{debug}");
+    }
+
+    #[test]
+    fn strict_intersection_masks_both_columns() {
+        use arrow_array::Int32Array;
+        let udf: Arc<dyn krishiv_udf_sdk::ScalarUdf> =
+            Arc::new(Identity::new(int_sig(), true, true));
+        // Two-argument strict UDF: bind with two INTs via a custom signature.
+        let two = Signature::Exact(vec![
+            UdfInputType::Exact(DataType::Integer),
+            UdfInputType::Exact(DataType::Integer),
+        ]);
+        let udf2: Arc<dyn krishiv_udf_sdk::ScalarUdf> = Arc::new(Identity::new(two, true, true));
+        let bound = bind_udf(
+            &udf2,
+            &[ArrowType::Int32, ArrowType::Int32],
+            &DataType::Integer,
+            true,
+            true,
+            Some(0),
+        )
+        .unwrap();
+        // Nulls in either column mask the row (intersection).
+        let a = Arc::new(Int32Array::from(vec![Some(1), None, Some(3)]));
+        let b = Arc::new(Int32Array::from(vec![Some(1), Some(2), None]));
+        let out = bound.invoke(&[Arg::Array(a), Arg::Array(b)], 3).unwrap();
+        let out = out.as_any().downcast_ref::<Int32Array>().unwrap();
+        assert_eq!(out.len(), 3);
+        assert!(out.is_null(1) && out.is_null(2));
+        assert_eq!(out.value(0), 1);
+        let _ = udf;
+    }
+
+    #[test]
+    fn masked_wrong_row_counts_are_internal() {
+        use arrow_array::Int32Array;
+        use arrow_buffer::BooleanBuffer;
+        // `take`/`scatter` length mismatches are engine bugs.
+        let valid = BooleanBuffer::from(vec![true, false, true]);
+        let wrong = Arc::new(Int32Array::from(vec![1])) as ArrayRef;
+        let err = scatter(&wrong, &valid).unwrap_err();
+        assert_eq!(err.error_class(), ErrorClass::InternalError);
+        let err = take(&wrong, &[usize::MAX]).unwrap_err();
+        assert_eq!(err.error_class(), ErrorClass::InternalError);
+        // The fixtures expose their declared fields.
+        let id = Identity::new(int_sig(), true, true);
+        assert!(id.return_field(&[]).is_ok());
+        let broken = Broken { what: "other" };
+        assert!(broken.return_field(&[]).is_ok());
+        let array: ArrayRef = Arc::new(Int32Array::from(vec![7]));
+        let out = broken
+            .invoke(
+                &[UdfArg::Column(&array)],
+                1,
+                &InvokeContext {
+                    partition: 0,
+                    ansi: true,
+                    time_zone: None,
+                },
+            )
+            .unwrap();
+        assert_eq!(out.len(), 1);
+        let meta = PanicMeta { what: "other" };
+        assert!(meta.return_field(&[]).is_ok());
+        let out = meta
+            .invoke(
+                &[UdfArg::Column(&array)],
+                1,
+                &InvokeContext {
+                    partition: 0,
+                    ansi: true,
+                    time_zone: None,
+                },
+            )
+            .unwrap();
+        assert_eq!(out.len(), 1);
+    }
+}
diff --git a/crates/krishiv-optimizer/Cargo.toml b/crates/krishiv-optimizer/Cargo.toml
index fbb40db8d..b107eccc5 100644
--- a/crates/krishiv-optimizer/Cargo.toml
+++ b/crates/krishiv-optimizer/Cargo.toml
@@ -16,6 +16,7 @@ krishiv-functions = { path = "../krishiv-functions" }
 krishiv-kernels = { path = "../krishiv-kernels" }
 krishiv-plan = { path = "../krishiv-plan" }
 krishiv-types = { path = "../krishiv-types" }
+krishiv-udf-sdk = { path = "../krishiv-udf-sdk" }
 
 [dev-dependencies]
 criterion.workspace = true
diff --git a/crates/krishiv-optimizer/src/fold.rs b/crates/krishiv-optimizer/src/fold.rs
index f075693c7..b3d01267e 100644
--- a/crates/krishiv-optimizer/src/fold.rs
+++ b/crates/krishiv-optimizer/src/fold.rs
@@ -20,11 +20,17 @@ use arrow_array::types::{
 use arrow_array::{
     Array, ArrayRef, BooleanArray, Date32Array, Decimal128Array, Float32Array, Float64Array,
     Int8Array, Int16Array, Int32Array, Int64Array, StringArray, TimestampMicrosecondArray,
+    new_null_array,
 };
 use arrow_schema::{DataType as ArrowType, TimeUnit};
+use krishiv_functions::scalar::{Arg, bind_udf};
 use krishiv_kernels::cast::{CastMode as KernelMode, CastOptions, FixedOffset, cast};
-use krishiv_plan::{Builtin, CastMode, Expr, ExprNode, Literal, ResolvedFunction};
+use krishiv_plan::{
+    Builtin, CastMode, Expr, ExprNode, FunctionId, FunctionKind, Literal, LogicalPlan, PlanNode,
+    ResolvedExpr, ResolvedFunction,
+};
 use krishiv_types::{DataType, DecimalType};
+use krishiv_udf_sdk::UdfLibrary;
 
 use crate::expr::{builtin, data_type, is_deterministic, lit, nullable, recall, same};
 
@@ -370,6 +376,7 @@ fn arrow_type(t: &DataType) -> Option<ArrowType> {
     })
 }
 
+/// A literal as a one-row array of its type's Arrow form.
 fn to_array(l: &Literal) -> Option<ArrayRef> {
     Some(match l {
         Literal::Boolean(v) => Arc::new(BooleanArray::from(vec![*v])),
@@ -452,6 +459,189 @@ fn fold_cast(l: &Literal, to: &DataType, mode: CastMode) -> Option<Literal> {
     from_array(out.as_ref(), to)
 }
 
+/// What UDF folding evaluates with: the session's library and the plain
+/// values a UDF call may read (ANSI flag, session time zone). The partition
+/// index is always zero when folding: a UDF reading it must declare itself
+/// nondeterministic, and nondeterministic calls never fold.
+pub(crate) struct UdfFoldCtx<'a> {
+    /// The session's UDFs, resolved by (name, version).
+    pub(crate) library: &'a UdfLibrary,
+    /// `spark.sql.ansi.enabled`.
+    pub(crate) ansi: bool,
+    /// The session time zone as a fixed offset in seconds, when it is one.
+    pub(crate) zone: Option<i32>,
+}
+
+/// `p` with every deterministic scalar session-UDF call of literal
+/// arguments folded to its value (nested calls fold bottom-up). Anything
+/// else is unchanged: a failure, an unregistered version or a result the
+/// literals cannot hold leaves the call in the plan, so the error surfaces
+/// at execution. An aggregate grouping by expressions is left alone, as in
+/// `fold_node`: folding either side could break the output matching.
+pub(crate) fn fold_plan(p: Arc<LogicalPlan>, ctx: &UdfFoldCtx<'_>) -> Arc<LogicalPlan> {
+    if let PlanNode::Aggregate { grouping, .. } = &p.node
+        && !super::groups_by_columns(grouping)
+    {
+        return p;
+    }
+    let out = p.map_expressions(|e| {
+        e.transform_up(&mut |x| Ok::<_, std::convert::Infallible>(fold_udf(&x, ctx)))
+    });
+    match out {
+        Ok(v) => v,
+        Err(never) => match never {},
+    }
+}
+
+/// One UDF folding step: a deterministic scalar session-UDF call whose
+/// arguments are all literals becomes its value, through the same binding
+/// execution uses. Anything else is unchanged.
+fn fold_udf(e: &Arc<Expr>, ctx: &UdfFoldCtx<'_>) -> Arc<Expr> {
+    let ExprNode::Resolved(ResolvedExpr::Function(f)) = &e.node else {
+        return Arc::clone(e);
+    };
+    let FunctionId::Udf { name, version } = &f.id else {
+        return Arc::clone(e);
+    };
+    if f.kind != FunctionKind::Scalar
+        || !f.deterministic
+        || f.distinct
+        || f.filter.is_some()
+        || !f
+            .args
+            .iter()
+            .all(|a| matches!(a.node, ExprNode::Literal(_)))
+    {
+        return Arc::clone(e);
+    }
+    let Some(udf) = ctx.library.get_versioned(name, *version) else {
+        return Arc::clone(e);
+    };
+    let literals: Vec<ArrayRef> = match f
+        .args
+        .iter()
+        .map(|a| match &a.node {
+            ExprNode::Literal(l) => udf_array(l),
+            _ => None,
+        })
+        .collect::<Option<Vec<_>>>()
+    {
+        Some(literals) => literals,
+        None => return Arc::clone(e),
+    };
+    let arg_types: Vec<ArrowType> = literals.iter().map(|a| a.data_type().clone()).collect();
+    let Ok(bound) = bind_udf(
+        &udf,
+        &arg_types,
+        &f.data_type,
+        f.nullable,
+        ctx.ansi,
+        ctx.zone,
+    ) else {
+        return Arc::clone(e);
+    };
+    let args: Vec<Arg> = literals.into_iter().map(Arg::Scalar).collect();
+    let Ok(out) = bound.invoke(&args, 1) else {
+        return Arc::clone(e);
+    };
+    udf_literal(&out, &f.data_type).unwrap_or_else(|| Arc::clone(e))
+}
+
+/// A literal as a one-row array, for UDF arguments: every scalar literal
+/// (intervals have no UDF form).
+fn udf_array(l: &Literal) -> Option<ArrayRef> {
+    Some(match l {
+        Literal::Null(None) => Arc::new(arrow_array::NullArray::new(1)),
+        Literal::Null(Some(t)) => new_null_array(&t.to_arrow(), 1),
+        Literal::Boolean(v) => Arc::new(BooleanArray::from(vec![*v])),
+        Literal::Byte(v) => Arc::new(Int8Array::from(vec![*v])),
+        Literal::Short(v) => Arc::new(Int16Array::from(vec![*v])),
+        Literal::Integer(v) => Arc::new(Int32Array::from(vec![*v])),
+        Literal::Long(v) => Arc::new(Int64Array::from(vec![*v])),
+        Literal::Float(v) => Arc::new(Float32Array::from(vec![*v])),
+        Literal::Double(v) => Arc::new(Float64Array::from(vec![*v])),
+        Literal::Decimal {
+            unscaled,
+            data_type,
+        } => Arc::new(
+            Decimal128Array::from(vec![*unscaled])
+                .with_precision_and_scale(
+                    data_type.precision(),
+                    i8::try_from(data_type.scale()).ok()?,
+                )
+                .ok()?,
+        ),
+        Literal::String(v) => Arc::new(StringArray::from(vec![v.as_str()])),
+        Literal::Binary(v) => Arc::new(arrow_array::BinaryArray::from_iter_values([v.as_slice()])),
+        Literal::Date(v) => Arc::new(Date32Array::from(vec![*v])),
+        Literal::Timestamp(v) => Arc::new(
+            TimestampMicrosecondArray::from(vec![*v])
+                .with_data_type(DataType::Timestamp.to_arrow()),
+        ),
+        Literal::TimestampNtz(v) => Arc::new(TimestampMicrosecondArray::from(vec![*v])),
+        // Intervals and any future literal kind have no UDF form.
+        _ => return None,
+    })
+}
+
+/// A one-row UDF result as the literal of type `t`: `None` for an array
+/// the literals cannot hold (binary views aside, every plain carrier).
+fn udf_literal(a: &ArrayRef, t: &DataType) -> Option<Arc<Expr>> {
+    if a.len() != 1 {
+        return None;
+    }
+    if a.is_null(0) {
+        return Some(lit(match t {
+            DataType::Null => Literal::Null(None),
+            _ => Literal::Null(Some(t.clone())),
+        }));
+    }
+    let literal = match (t, a.data_type()) {
+        (DataType::Boolean, _) => Literal::Boolean(a.as_boolean_opt()?.value(0)),
+        (DataType::Byte, _) => Literal::Byte(a.as_primitive_opt::<Int8Type>()?.value(0)),
+        (DataType::Short, _) => Literal::Short(a.as_primitive_opt::<Int16Type>()?.value(0)),
+        (DataType::Integer, _) => Literal::Integer(a.as_primitive_opt::<Int32Type>()?.value(0)),
+        (DataType::Long, _) => Literal::Long(a.as_primitive_opt::<Int64Type>()?.value(0)),
+        (DataType::Float, _) => Literal::Float(a.as_primitive_opt::<Float32Type>()?.value(0)),
+        (DataType::Double, _) => Literal::Double(a.as_primitive_opt::<Float64Type>()?.value(0)),
+        (DataType::Decimal(d), ArrowType::Decimal128(p, s))
+            if *p == d.precision() && i8::try_from(d.scale()).ok() == Some(*s) =>
+        {
+            Literal::Decimal {
+                unscaled: a.as_primitive_opt::<Decimal128Type>()?.value(0),
+                data_type: DecimalType::try_new(u32::from(*p), u32::from(d.scale())).ok()?,
+            }
+        }
+        (DataType::String, ArrowType::Utf8) => {
+            Literal::String(a.as_string_opt::<i32>()?.value(0).to_owned())
+        }
+        (DataType::String, ArrowType::Utf8View) => {
+            Literal::String(a.as_string_view_opt()?.value(0).to_owned())
+        }
+        (DataType::String, ArrowType::LargeUtf8) => {
+            Literal::String(a.as_string_opt::<i64>()?.value(0).to_owned())
+        }
+        (DataType::Binary, ArrowType::Binary) => {
+            Literal::Binary(a.as_binary_opt::<i32>()?.value(0).to_owned())
+        }
+        (DataType::Binary, ArrowType::BinaryView) => {
+            Literal::Binary(a.as_binary_view_opt()?.value(0).to_owned())
+        }
+        (DataType::Binary, ArrowType::LargeBinary) => {
+            Literal::Binary(a.as_binary_opt::<i64>()?.value(0).to_owned())
+        }
+        (DataType::Date, _) => Literal::Date(a.as_primitive_opt::<Date32Type>()?.value(0)),
+        (DataType::Timestamp, ArrowType::Timestamp(TimeUnit::Microsecond, _)) => {
+            Literal::Timestamp(a.as_primitive_opt::<TimestampMicrosecondType>()?.value(0))
+        }
+        (DataType::TimestampNtz, ArrowType::Timestamp(TimeUnit::Microsecond, None)) => {
+            Literal::TimestampNtz(a.as_primitive_opt::<TimestampMicrosecondType>()?.value(0))
+        }
+        _ => return None,
+    };
+    Some(lit(literal))
+}
+
 #[cfg(test)]
 mod tests {
     use std::cmp::Ordering;
diff --git a/crates/krishiv-optimizer/src/lib.rs b/crates/krishiv-optimizer/src/lib.rs
index 1bd991f81..e401d951f 100644
--- a/crates/krishiv-optimizer/src/lib.rs
+++ b/crates/krishiv-optimizer/src/lib.rs
@@ -54,8 +54,10 @@ mod sum_rewrite;
 
 use std::sync::Arc;
 
+use krishiv_common::config::{ANSI_ENABLED, Config, SESSION_TIME_ZONE};
 use krishiv_common::error::{InternalError, KrishivError};
 use krishiv_plan::{Expr, ExprNode, Grouping, LogicalPlan, Plan, PlanNode, ResolvedExpr};
+use krishiv_udf_sdk::UdfLibrary;
 
 pub use group_limit::{
     DEFAULT_WINDOW_GROUP_LIMIT_THRESHOLD, RankLikeFunction, WindowGroupLimit,
@@ -114,7 +116,23 @@ pub fn optimize(plan: &Plan) -> Result<Plan, KrishivError> {
 /// be started. A rewrite nesting deeper than [`krishiv_plan::MAX_DEPTH`] is
 /// not an error: the input plan is returned unoptimised.
 pub fn optimize_with(plan: &Plan, stats: &dyn Statistics) -> Result<Plan, KrishivError> {
-    Ok(run(plan, Some(stats), false)?.0)
+    Ok(run(plan, Some(stats), false, None)?.0)
+}
+
+/// As [`optimize_with`], also folding deterministic session-UDF calls of
+/// literal arguments to their values (`udfs`, with the session settings in
+/// `config`). A failure leaves the call in the plan, so the error surfaces
+/// at execution.
+///
+/// # Errors
+/// As [`optimize_with`].
+pub fn optimize_with_udfs(
+    plan: &Plan,
+    stats: &dyn Statistics,
+    udfs: &UdfLibrary,
+    config: &Config,
+) -> Result<Plan, KrishivError> {
+    Ok(run(plan, Some(stats), false, Some((udfs, config)))?.0)
 }
 
 /// As [`optimize_with`], also returning every rule application that
@@ -128,7 +146,21 @@ pub fn optimize_traced(
     plan: &Plan,
     stats: &dyn Statistics,
 ) -> Result<(Plan, Vec<RuleStep>), KrishivError> {
-    run(plan, Some(stats), true)
+    run(plan, Some(stats), true, None)
+}
+
+/// As [`optimize_traced`], also folding deterministic session-UDF calls of
+/// literal arguments to their values (see [`optimize_with_udfs`]).
+///
+/// # Errors
+/// As [`optimize_with`].
+pub fn optimize_traced_with_udfs(
+    plan: &Plan,
+    stats: &dyn Statistics,
+    udfs: &UdfLibrary,
+    config: &Config,
+) -> Result<(Plan, Vec<RuleStep>), KrishivError> {
+    run(plan, Some(stats), true, Some((udfs, config)))
 }
 
 /// As [`optimize_with`], keeping the joins in the order the query wrote
@@ -137,7 +169,7 @@ pub fn optimize_traced(
 /// # Errors
 /// As [`optimize_with`].
 pub fn optimize_as_written(plan: &Plan) -> Result<Plan, KrishivError> {
-    Ok(run(plan, None, false)?.0)
+    Ok(run(plan, None, false, None)?.0)
 }
 
 /// Records the steps that changed the plan, when tracing.
@@ -182,6 +214,7 @@ fn run(
     plan: &Plan,
     stats: Option<&dyn Statistics>,
     tracing: bool,
+    udfs: Option<(&UdfLibrary, &Config)>,
 ) -> Result<(Plan, Vec<RuleStep>), KrishivError> {
     if !plan.root().is_resolved() {
         return Err(InternalError {
@@ -200,7 +233,28 @@ fn run(
                 Ok(pushdown::imply_join_condition(p))
             })
         })?;
-        let root = batch(root, "Rewrite", &mut t)?;
+        // UDF calls of literals fold with the rewrite batch to a fixed
+        // point: folding exposes the constants rewriting folds, and
+        // rewriting exposes the literals folding folds (casts, arithmetic
+        // and nested calls), so neither alone reaches the fixed point.
+        // Only this pass needs the UDFs.
+        let mut root = root;
+        if let Some((library, config)) = udfs {
+            for round in 1..=MAX_ITERATIONS {
+                let before = Arc::clone(&root);
+                let prev = Arc::clone(&root);
+                root = dag::rewrite_up(Arc::clone(&root), &mut |p| {
+                    Ok(fold::fold_plan(p, &fold_ctx(library, config)))
+                })?;
+                t.step("FoldUdfs", round, "FoldUdfs", &prev, &root);
+                root = batch(root, "Rewrite", &mut t)?;
+                if Arc::ptr_eq(&before, &root) {
+                    break;
+                }
+            }
+        } else {
+            root = batch(root, "Rewrite", &mut t)?;
+        }
         let root = t.once("AlgebraicSum", &root, |r| {
             sum_rewrite::rewrite(Arc::clone(r))
         })?;
@@ -242,6 +296,27 @@ fn run(
     }
 }
 
+/// The UDF folding context of one optimization: the session's library and
+/// the plain values a folded UDF call may read.
+fn fold_ctx<'a>(library: &'a UdfLibrary, config: &'a Config) -> fold::UdfFoldCtx<'a> {
+    use krishiv_common::config::ConfigValue;
+    use krishiv_kernels::cast::FixedOffset;
+
+    let ansi = config
+        .get(&ANSI_ENABLED)
+        .and_then(ConfigValue::as_bool)
+        .unwrap_or(true);
+    let zone = config
+        .get(&SESSION_TIME_ZONE)
+        .and_then(|v| v.as_str())
+        .and_then(|z| FixedOffset::parse(z).map(|o| o.0));
+    fold::UdfFoldCtx {
+        library,
+        ansi,
+        zone,
+    }
+}
+
 /// Runs [`REWRITE`] to a fixed point.
 fn batch(
     mut root: Arc<LogicalPlan>,
@@ -278,7 +353,7 @@ fn fold_node(p: Arc<LogicalPlan>) -> Arc<LogicalPlan> {
     }
 }
 
-fn groups_by_columns(g: &Grouping) -> bool {
+pub(crate) fn groups_by_columns(g: &Grouping) -> bool {
     let column = |e: &Arc<Expr>| matches!(e.node, ExprNode::Resolved(ResolvedExpr::Column(_)));
     match g {
         Grouping::GroupBy(v) | Grouping::Rollup(v) | Grouping::Cube(v) => v.iter().all(column),
diff --git a/crates/krishiv-optimizer/tests/it/main.rs b/crates/krishiv-optimizer/tests/it/main.rs
index e1191d70e..eaa6009ff 100644
--- a/crates/krishiv-optimizer/tests/it/main.rs
+++ b/crates/krishiv-optimizer/tests/it/main.rs
@@ -14,3 +14,4 @@ mod rules;
 mod sum_rewrite;
 mod support;
 mod tpch;
+mod udf;
diff --git a/crates/krishiv-optimizer/tests/it/udf.rs b/crates/krishiv-optimizer/tests/it/udf.rs
new file mode 100644
index 000000000..7819f40d6
--- /dev/null
+++ b/crates/krishiv-optimizer/tests/it/udf.rs
@@ -0,0 +1,545 @@
+// SPDX-License-Identifier: Apache-2.0
+//! Session UDFs in the optimizer: deterministic calls of literal arguments
+//! fold to their values (through the same binding execution uses), and
+//! anything else stays in the plan.
+
+use std::sync::Arc;
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+use arrow_array::ArrayRef;
+use krishiv_common::config::Config;
+use krishiv_optimizer::{NoStatistics, optimize_with_udfs};
+use krishiv_plan::{
+    Builtin, CastMode, Expr, ExprNode, FunctionId, FunctionKind, Literal, LogicalPlan, Plan,
+    PlanNode, ResolvedExpr, ResolvedFunction,
+};
+use krishiv_types::DataType;
+use krishiv_udf_sdk::{
+    ArgField, InvokeContext, ReturnField, ScalarUdf, Signature, UdfArg, UdfError, UdfInputType,
+    UdfLibrary,
+};
+
+/// `my_udf(x) = x + 1` over `INT`, deterministic or not, counting its
+/// invocations.
+#[derive(Debug)]
+struct PlusOne {
+    deterministic: bool,
+    calls: Arc<AtomicUsize>,
+}
+
+impl ScalarUdf for PlusOne {
+    fn name(&self) -> &str {
+        "my_udf"
+    }
+
+    fn version(&self) -> u32 {
+        2
+    }
+
+    fn signature(&self) -> &Signature {
+        use std::sync::OnceLock;
+        static SIG: OnceLock<Signature> = OnceLock::new();
+        SIG.get_or_init(|| Signature::Exact(vec![UdfInputType::Exact(DataType::Integer)]))
+    }
+
+    fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+        Ok(ReturnField {
+            data_type: DataType::Integer,
+            nullable: true,
+        })
+    }
+
+    fn properties(&self) -> krishiv_udf_sdk::UdfProperties {
+        krishiv_udf_sdk::UdfProperties {
+            deterministic: self.deterministic,
+            null_handling: krishiv_udf_sdk::NullHandling::Strict,
+        }
+    }
+
+    fn invoke(
+        &self,
+        args: &[UdfArg<'_>],
+        rows: usize,
+        _: &InvokeContext,
+    ) -> Result<ArrayRef, UdfError> {
+        use arrow_array::Int32Array;
+        self.calls.fetch_add(1, Ordering::Relaxed);
+        let input = args[0].array();
+        let input = input
+            .as_any()
+            .downcast_ref::<Int32Array>()
+            .ok_or_else(|| UdfError::new("my_udf needs INT"))?;
+        assert_eq!(
+            input.len(),
+            if matches!(args[0], UdfArg::Scalar(_)) {
+                1
+            } else {
+                rows
+            }
+        );
+        Ok(Arc::new(
+            input
+                .iter()
+                .map(|v| v.map(|v| v.wrapping_add(1)))
+                .collect::<Int32Array>(),
+        ))
+    }
+}
+
+fn call(deterministic: bool) -> Arc<Expr> {
+    versioned_call(deterministic, 2)
+}
+
+fn versioned_call(deterministic: bool, version: u32) -> Arc<Expr> {
+    Arc::new(Expr::new(ExprNode::Resolved(ResolvedExpr::Function(
+        ResolvedFunction {
+            id: FunctionId::Udf {
+                name: "my_udf".to_owned(),
+                version,
+            },
+            kind: FunctionKind::Scalar,
+            args: vec![Arc::new(Expr::literal(Literal::Integer(41)))],
+            distinct: false,
+            filter: None,
+            data_type: DataType::Integer,
+            nullable: true,
+            deterministic,
+        },
+    ))))
+}
+
+fn plan(call: Arc<Expr>) -> Plan {
+    Plan::try_new(LogicalPlan::new(PlanNode::Project {
+        input: Arc::new(LogicalPlan::new(PlanNode::OneRowRelation)),
+        exprs: vec![call],
+    }))
+    .unwrap()
+}
+
+fn config() -> Config {
+    Config::from_pairs(Vec::<(String, String)>::new())
+        .unwrap()
+        .0
+}
+
+fn project_expr(plan: &Plan) -> Arc<Expr> {
+    match &plan.root().node {
+        PlanNode::Project { exprs, .. } => Arc::clone(&exprs[0]),
+        other => panic!("a project, not {other:?}"),
+    }
+}
+
+#[test]
+fn a_deterministic_udf_of_literals_folds_to_its_value() {
+    let lib = Arc::new(UdfLibrary::new());
+    let calls = Arc::new(AtomicUsize::new(0));
+    lib.register(Arc::new(PlusOne {
+        deterministic: true,
+        calls: Arc::clone(&calls),
+    }))
+    .unwrap();
+    let optimized = optimize_with_udfs(&plan(call(true)), &NoStatistics, &lib, &config()).unwrap();
+    // Folded (through one invocation), to the UDF's value.
+    assert_eq!(calls.load(Ordering::Relaxed), 1);
+    assert_eq!(
+        project_expr(&optimized).node,
+        Expr::new(ExprNode::Literal(Literal::Integer(42))).node
+    );
+}
+
+#[test]
+fn other_udf_calls_stay_in_the_plan() {
+    let lib = Arc::new(UdfLibrary::new());
+    let calls = Arc::new(AtomicUsize::new(0));
+    lib.register(Arc::new(PlusOne {
+        deterministic: true,
+        calls: Arc::clone(&calls),
+    }))
+    .unwrap();
+    let config = config();
+    // Nondeterministic calls never fold.
+    let optimized = optimize_with_udfs(&plan(call(false)), &NoStatistics, &lib, &config).unwrap();
+    assert_eq!(calls.load(Ordering::Relaxed), 0);
+    assert!(matches!(
+        &project_expr(&optimized).node,
+        ExprNode::Resolved(ResolvedExpr::Function(_))
+    ));
+    // An unregistered version never folds either: `PlusOne` is at
+    // version 2, so a call at version 3 stays in the plan.
+    let optimized =
+        optimize_with_udfs(&plan(versioned_call(true, 3)), &NoStatistics, &lib, &config).unwrap();
+    assert_eq!(calls.load(Ordering::Relaxed), 0);
+    assert!(matches!(
+        &project_expr(&optimized).node,
+        ExprNode::Resolved(ResolvedExpr::Function(_))
+    ));
+}
+
+#[test]
+fn udf_calls_fold_once_their_arguments_do() {
+    // Arithmetic, casts and nested UDF calls are not literals on the
+    // first pass: the rewrite batch folds them, then the UDF pass folds
+    // the calls, to a fixed point.
+    fn builtin(op: Builtin, args: Vec<Arc<Expr>>, data_type: DataType) -> Arc<Expr> {
+        Arc::new(Expr::new(ExprNode::Resolved(ResolvedExpr::Function(
+            ResolvedFunction {
+                id: FunctionId::Builtin(op),
+                kind: FunctionKind::Scalar,
+                args,
+                distinct: false,
+                filter: None,
+                data_type,
+                nullable: true,
+                deterministic: true,
+            },
+        ))))
+    }
+    fn udf(arg: Arc<Expr>) -> Arc<Expr> {
+        Arc::new(Expr::new(ExprNode::Resolved(ResolvedExpr::Function(
+            ResolvedFunction {
+                id: FunctionId::Udf {
+                    name: "my_udf".to_owned(),
+                    version: 2,
+                },
+                kind: FunctionKind::Scalar,
+                args: vec![arg],
+                distinct: false,
+                filter: None,
+                data_type: DataType::Integer,
+                nullable: true,
+                deterministic: true,
+            },
+        ))))
+    }
+    fn cast(arg: Arc<Expr>, to: DataType) -> Arc<Expr> {
+        // A pinned mode is resolved (`Default` is the analyzer's to pin).
+        Arc::new(Expr::new(ExprNode::Cast {
+            expr: arg,
+            to,
+            mode: CastMode::Ansi,
+        }))
+    }
+    fn fold(arg: Arc<Expr>) -> (Arc<Expr>, usize) {
+        let lib = Arc::new(UdfLibrary::new());
+        let calls = Arc::new(AtomicUsize::new(0));
+        lib.register(Arc::new(PlusOne {
+            deterministic: true,
+            calls: Arc::clone(&calls),
+        }))
+        .unwrap();
+        let optimized =
+            optimize_with_udfs(&plan(udf(arg)), &NoStatistics, &lib, &config()).unwrap();
+        (project_expr(&optimized), calls.load(Ordering::Relaxed))
+    }
+    let lit = |v: i32| Arc::new(Expr::literal(Literal::Integer(v)));
+    // `my_udf(1 + 2)` folds once the rewrite batch folds the sum.
+    let (folded, calls) = fold(builtin(
+        Builtin::Add,
+        vec![lit(1), lit(2)],
+        DataType::Integer,
+    ));
+    assert_eq!(folded.node, Expr::literal(Literal::Integer(4)).node);
+    assert_eq!(calls, 1);
+    // `my_udf(CAST(41L AS INT))` folds once the cast folds.
+    let (folded, calls) = fold(cast(
+        Arc::new(Expr::literal(Literal::Long(41))),
+        DataType::Integer,
+    ));
+    assert_eq!(folded.node, Expr::literal(Literal::Integer(42)).node);
+    assert_eq!(calls, 1);
+    // `my_udf(CAST(my_udf(1 + 2) AS INT))` takes two rounds: the inner
+    // call folds first, then the cast, then the outer call.
+    let inner = udf(builtin(
+        Builtin::Add,
+        vec![lit(1), lit(2)],
+        DataType::Integer,
+    ));
+    let (folded, calls) = fold(cast(inner, DataType::Integer));
+    assert_eq!(folded.node, Expr::literal(Literal::Integer(5)).node);
+    assert_eq!(calls, 2);
+}
+
+/// An identity UDF over every scalar literal type: folding covers each
+/// `udf_array`/`udf_literal` arm, and nulls fold to null.
+#[derive(Debug)]
+struct TypedIdentity {
+    data_type: DataType,
+}
+
+impl ScalarUdf for TypedIdentity {
+    fn name(&self) -> &str {
+        "typed_identity"
+    }
+    fn version(&self) -> u32 {
+        1
+    }
+    fn signature(&self) -> &Signature {
+        use std::sync::OnceLock;
+        static SIG: OnceLock<Signature> = OnceLock::new();
+        SIG.get_or_init(|| Signature::Exact(vec![UdfInputType::Any]))
+    }
+    fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+        Ok(ReturnField {
+            data_type: self.data_type.clone(),
+            nullable: true,
+        })
+    }
+    fn properties(&self) -> krishiv_udf_sdk::UdfProperties {
+        krishiv_udf_sdk::UdfProperties {
+            deterministic: true,
+            null_handling: krishiv_udf_sdk::NullHandling::Strict,
+        }
+    }
+    fn invoke(
+        &self,
+        args: &[UdfArg<'_>],
+        _rows: usize,
+        _: &InvokeContext,
+    ) -> Result<ArrayRef, UdfError> {
+        Ok(args[0].array())
+    }
+}
+
+fn typed_call(data_type: DataType, literal: Literal) -> Arc<Expr> {
+    Arc::new(Expr::new(ExprNode::Resolved(ResolvedExpr::Function(
+        ResolvedFunction {
+            id: FunctionId::Udf {
+                name: "typed_identity".to_owned(),
+                version: 1,
+            },
+            kind: FunctionKind::Scalar,
+            args: vec![Arc::new(Expr::literal(literal))],
+            distinct: false,
+            filter: None,
+            data_type,
+            nullable: true,
+            deterministic: true,
+        },
+    ))))
+}
+
+fn fold_typed(
+    data_type: DataType,
+    literal: Literal,
+    lib: &UdfLibrary,
+    config: &Config,
+) -> Arc<Expr> {
+    let p = Plan::try_new(LogicalPlan::new(PlanNode::Project {
+        input: Arc::new(LogicalPlan::new(PlanNode::OneRowRelation)),
+        exprs: vec![typed_call(data_type, literal)],
+    }))
+    .unwrap();
+    project_expr(&optimize_with_udfs(&p, &NoStatistics, lib, config).unwrap())
+}
+
+#[test]
+fn udf_folding_covers_every_scalar_type() {
+    use krishiv_types::DecimalType;
+    // Register one UDF per tested type (the library keys by name; reuse
+    // the same name with the call's type, since folding reads the call).
+    let config = config();
+    let dec = |u: i128| Literal::Decimal {
+        unscaled: u,
+        data_type: DecimalType::try_new(10, 2).unwrap(),
+    };
+    let cases: Vec<(DataType, Literal)> = vec![
+        (DataType::Boolean, Literal::Boolean(true)),
+        (DataType::Byte, Literal::Byte(7)),
+        (DataType::Short, Literal::Short(7)),
+        (DataType::Integer, Literal::Integer(7)),
+        (DataType::Long, Literal::Long(7)),
+        (DataType::Float, Literal::Float(1.5)),
+        (DataType::Double, Literal::Double(2.5)),
+        (
+            DataType::Decimal(DecimalType::try_new(10, 2).unwrap()),
+            dec(150),
+        ),
+        (DataType::String, Literal::String("hi".to_owned())),
+        (DataType::Binary, Literal::Binary(vec![1, 2])),
+        (DataType::Date, Literal::Date(3)),
+        (DataType::Timestamp, Literal::Timestamp(4)),
+        (DataType::TimestampNtz, Literal::TimestampNtz(5)),
+        (DataType::Integer, Literal::Null(Some(DataType::Integer))),
+    ];
+    for (data_type, literal) in cases {
+        let lib = Arc::new(UdfLibrary::new());
+        lib.register(Arc::new(TypedIdentity {
+            data_type: data_type.clone(),
+        }))
+        .unwrap();
+        let folded = fold_typed(data_type.clone(), literal.clone(), &lib, &config);
+        assert!(
+            matches!(folded.node, ExprNode::Literal(_)),
+            "{data_type:?} folds to a literal, not {:?}",
+            folded.node
+        );
+    }
+}
+
+#[test]
+fn udf_folding_leaves_unfoldables_in_the_plan() {
+    use krishiv_plan::Literal as L;
+    let lib = Arc::new(UdfLibrary::new());
+    lib.register(Arc::new(TypedIdentity {
+        data_type: DataType::Integer,
+    }))
+    .unwrap();
+    let config = config();
+    // An interval literal has no UDF form.
+    let interval = L::DayTimeInterval {
+        micros: 1,
+        start: krishiv_plan::DayTimeField::Day,
+        end: krishiv_plan::DayTimeField::Day,
+    };
+    let folded = fold_typed(DataType::Integer, interval, &lib, &config);
+    assert!(matches!(
+        folded.node,
+        ExprNode::Resolved(ResolvedExpr::Function(_))
+    ));
+    // DISTINCT, FILTER and aggregate calls never fold.
+    let base = ResolvedFunction {
+        id: FunctionId::Udf {
+            name: "typed_identity".to_owned(),
+            version: 1,
+        },
+        kind: FunctionKind::Scalar,
+        args: vec![Arc::new(Expr::literal(L::Integer(1)))],
+        distinct: false,
+        filter: None,
+        data_type: DataType::Integer,
+        nullable: true,
+        deterministic: true,
+    };
+    let variants = [
+        ResolvedFunction {
+            distinct: true,
+            ..base.clone()
+        },
+        ResolvedFunction {
+            filter: Some(Arc::new(Expr::literal(L::Boolean(true)))),
+            ..base.clone()
+        },
+        ResolvedFunction {
+            kind: FunctionKind::Aggregate,
+            ..base
+        },
+    ];
+    for mut g in variants {
+        g.args = vec![Arc::new(Expr::literal(L::Integer(1)))];
+        let p = Plan::try_new(LogicalPlan::new(PlanNode::Project {
+            input: Arc::new(LogicalPlan::new(PlanNode::OneRowRelation)),
+            exprs: vec![Arc::new(Expr::new(ExprNode::Resolved(
+                ResolvedExpr::Function(g),
+            )))],
+        }))
+        .unwrap();
+        let out = project_expr(&optimize_with_udfs(&p, &NoStatistics, &lib, &config).unwrap());
+        assert!(matches!(
+            out.node,
+            ExprNode::Resolved(ResolvedExpr::Function(_))
+        ));
+    }
+    // A failing call stays in the plan (errors surface at execution).
+    #[derive(Debug)]
+    struct Failing;
+    impl ScalarUdf for Failing {
+        fn name(&self) -> &str {
+            "failing_udf"
+        }
+        fn version(&self) -> u32 {
+            1
+        }
+        fn signature(&self) -> &Signature {
+            use std::sync::OnceLock;
+            static SIG: OnceLock<Signature> = OnceLock::new();
+            SIG.get_or_init(|| Signature::Exact(vec![UdfInputType::Any]))
+        }
+        fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+            Ok(ReturnField {
+                data_type: DataType::Integer,
+                nullable: true,
+            })
+        }
+        fn invoke(
+            &self,
+            _: &[UdfArg<'_>],
+            _: usize,
+            _: &InvokeContext,
+        ) -> Result<ArrayRef, UdfError> {
+            Err(UdfError::new("boom"))
+        }
+    }
+    let lib2 = Arc::new(UdfLibrary::new());
+    lib2.register(Arc::new(Failing)).unwrap();
+    let p = Plan::try_new(LogicalPlan::new(PlanNode::Project {
+        input: Arc::new(LogicalPlan::new(PlanNode::OneRowRelation)),
+        exprs: vec![Arc::new(Expr::new(ExprNode::Resolved(
+            ResolvedExpr::Function(ResolvedFunction {
+                id: FunctionId::Udf {
+                    name: "failing_udf".to_owned(),
+                    version: 1,
+                },
+                kind: FunctionKind::Scalar,
+                args: vec![Arc::new(Expr::literal(L::Integer(1)))],
+                distinct: false,
+                filter: None,
+                data_type: DataType::Integer,
+                nullable: true,
+                deterministic: true,
+            }),
+        )))],
+    }))
+    .unwrap();
+    let out = project_expr(&optimize_with_udfs(&p, &NoStatistics, &lib2, &config).unwrap());
+    assert!(matches!(
+        out.node,
+        ExprNode::Resolved(ResolvedExpr::Function(_))
+    ));
+    // A non-literal argument never folds.
+    let resolved_col = || {
+        Arc::new(Expr::new(ExprNode::Resolved(ResolvedExpr::Column(
+            krishiv_plan::BoundColumn {
+                id: krishiv_plan::AttrId(1),
+                name: "a".to_owned(),
+                data_type: DataType::Integer,
+                nullable: true,
+            },
+        ))))
+    };
+    let p = Plan::try_new(LogicalPlan::new(PlanNode::Project {
+        input: Arc::new(LogicalPlan::new(PlanNode::OneRowRelation)),
+        exprs: vec![Arc::new(Expr::new(ExprNode::Resolved(
+            ResolvedExpr::Function(ResolvedFunction {
+                id: FunctionId::Udf {
+                    name: "typed_identity".to_owned(),
+                    version: 1,
+                },
+                kind: FunctionKind::Scalar,
+                args: vec![resolved_col()],
+                distinct: false,
+                filter: None,
+                data_type: DataType::Integer,
+                nullable: true,
+                deterministic: true,
+            }),
+        )))],
+    }))
+    .unwrap();
+    let out = project_expr(&optimize_with_udfs(&p, &NoStatistics, &lib, &config).unwrap());
+    assert!(matches!(
+        out.node,
+        ExprNode::Resolved(ResolvedExpr::Function(_))
+    ));
+    // An aggregate over expressions is left alone.
+    let agg = Arc::new(LogicalPlan::new(PlanNode::Aggregate {
+        input: Arc::new(LogicalPlan::new(PlanNode::OneRowRelation)),
+        grouping: krishiv_plan::Grouping::GroupBy(vec![typed_call(
+            DataType::Integer,
+            L::Integer(1),
+        )]),
+        aggregates: vec![],
+    }));
+    let p = Plan::try_new((*agg).clone()).unwrap();
+    let out = optimize_with_udfs(&p, &NoStatistics, &lib, &config).unwrap();
+    assert!(matches!(out.root().node, PlanNode::Aggregate { .. }));
+}
diff --git a/crates/krishiv-plan-codec/src/decode.rs b/crates/krishiv-plan-codec/src/decode.rs
index ac2de96bd..24485bc11 100644
--- a/crates/krishiv-plan-codec/src/decode.rs
+++ b/crates/krishiv-plan-codec/src/decode.rs
@@ -703,6 +703,11 @@ impl Decoder {
                 name: r.name.clone(),
                 id: r.id,
             },
+            pb::function::Id::Udf(u) => FunctionId::Udf {
+                name: u.name.clone(),
+                version: u32::try_from(u.version)
+                    .map_err(|_| corrupt("a UDF version out of range"))?,
+            },
         };
         Ok(ResolvedFunction {
             id,
diff --git a/crates/krishiv-plan-codec/src/encode.rs b/crates/krishiv-plan-codec/src/encode.rs
index d8e49b841..92349d7d9 100644
--- a/crates/krishiv-plan-codec/src/encode.rs
+++ b/crates/krishiv-plan-codec/src/encode.rs
@@ -527,6 +527,10 @@ impl Encoder {
                 name: name.clone(),
                 id: *id,
             }),
+            FunctionId::Udf { name, version } => pb::function::Id::Udf(pb::UdfFunction {
+                name: name.clone(),
+                version: u64::from(*version),
+            }),
             _ => return Err(unresolved("a function identity this version does not know")),
         };
         Ok(pb::Function {
diff --git a/crates/krishiv-plan-codec/src/features.rs b/crates/krishiv-plan-codec/src/features.rs
index 151956597..6cf799ccc 100644
--- a/crates/krishiv-plan-codec/src/features.rs
+++ b/crates/krishiv-plan-codec/src/features.rs
@@ -42,7 +42,7 @@ use krishiv_exec::JoinType;
 use krishiv_exec::aggregate::{AggregateFunction, is_moment};
 use krishiv_exec::physical::{HashScheme, Partitioning, PhysNode, PhysicalPlan, ProjectItemPlan};
 use krishiv_exec::window::{FrameBound, WindowFrame, WindowFunction};
-use krishiv_plan::{Expr, ExprNode, Literal, ResolvedExpr};
+use krishiv_plan::{Expr, ExprNode, FunctionId, Literal, ResolvedExpr};
 use krishiv_types::DataType;
 
 /// The `min_reader_version` of a plan that uses no feature (the epoch-1
@@ -127,6 +127,7 @@ registry! {
     (limit_offset, LimitOffset, 3, Semantic, "A `Limit` that skips leading rows (a nonzero offset)."),
     (map_key_dedup_policy, MapKeyDedupPolicy, POST_MIGRATION_READER_VERSION, Semantic, "The session's map-key dedup policy (`LAST_WIN`); without it a worker keeps the first value on duplicate map keys."),
     (nested_types, NestedTypes, POST_MIGRATION_READER_VERSION, Semantic, "Array, map and struct types (`DataType.KIND_NESTED`, written as Spark's JSON form of the type)."),
+    (rust_udf, RustUdf, POST_MIGRATION_READER_VERSION, Semantic, "A call of a session-registered native Rust UDF (`UdfFunction`, by name and version)."),
     (struct_field, StructField, POST_MIGRATION_READER_VERSION, Semantic, "A struct field access (`GetStructField`: the analyzer-resolved field of a struct)."),
     (window, Window, 4, Semantic, "The `Window` node and its functions."),
     (window_frame_offsets, WindowFrameOffsets, POST_MIGRATION_READER_VERSION, Semantic, "`ROWS` window frame bounds at an offset from the current row (`n PRECEDING`, `n FOLLOWING`)."),
@@ -170,6 +171,8 @@ pub enum Construct<'a> {
     Frame(&'a WindowFrame),
     /// An aggregate function (of an aggregate or a window).
     Aggregate(AggregateFunction),
+    /// A resolved function call: only a session UDF needs a feature.
+    Function(&'a FunctionId),
     /// A resolved expression (a struct field access needs its feature).
     Expr(&'a Expr),
     /// A Spark type in an expression or a column.
@@ -208,6 +211,10 @@ pub(crate) fn arrow_type_is_nested(t: &arrow_schema::DataType) -> bool {
 
 /// The feature `construct` needs, or `None` for the epoch-1 baseline.
 #[must_use]
+#[expect(
+    clippy::match_same_arms,
+    reason = "every current FunctionId is listed explicitly"
+)]
 pub fn feature_of(construct: Construct<'_>) -> Option<Feature> {
     match construct {
         Construct::Node(node) => match node {
@@ -318,6 +325,15 @@ pub fn feature_of(construct: Construct<'_>) -> Option<Feature> {
             | AggregateFunction::MaxBy
             | AggregateFunction::MinBy => None,
         },
+        // Built-ins and registry functions travel by name; only a
+        // session UDF (by name and version) needs a reader with it.
+        Construct::Function(id) => match id {
+            FunctionId::Udf { .. } => Some(Feature::RustUdf),
+            FunctionId::Builtin(_) => None,
+            // A future identity is baseline until it is classified
+            // (encoding refuses it first).
+            FunctionId::Registry { .. } | _ => None,
+        },
     }
 }
 
@@ -371,6 +387,9 @@ fn constructs_of<'a>(node: &'a PhysNode, f: &mut impl FnMut(Construct<'a>)) {
             f(Construct::Lambda);
         }
         f(Construct::Expr(e));
+        // A UDF call hides in any expression of the node (`exprs_of`
+        // already yields every descendant, so one node check is enough).
+        functions_in(e, f);
     }
 }
 
@@ -483,6 +502,20 @@ fn exprs_of<'a>(node: &'a PhysNode) -> Vec<&'a Arc<Expr>> {
     out
 }
 
+/// Calls `f` with the function call `e` holds, if one: only a session UDF
+/// needs a feature, so only that arm matters. The call site already visits
+/// every descendant (see `exprs_of`), so one node check covers the whole
+/// subtree. Every current [`ExprNode`] variant appears in the call-site
+/// walk explicitly, so a new expression kind holding a call cannot
+/// silently skip UDF feature detection (encoding refuses unknown nodes
+/// first). Physical expressions hold no subquery nodes (the codec refuses
+/// them).
+fn functions_in<'a>(e: &'a Arc<Expr>, f: &mut impl FnMut(Construct<'a>)) {
+    if let ExprNode::Resolved(ResolvedExpr::Function(c)) = &e.node {
+        f(Construct::Function(&c.id));
+    }
+}
+
 /// The features `plan` uses: a pure function of its content. Subquery plans
 /// count; nothing recurses. The expression environment counts too, but only
 /// around a moment aggregate: a plan whose session sets
diff --git a/crates/krishiv-plan-codec/src/proto/krishiv.plan.v1.pb.rs b/crates/krishiv-plan-codec/src/proto/krishiv.plan.v1.pb.rs
index cf6fcbd06..51e3f623e 100644
--- a/crates/krishiv-plan-codec/src/proto/krishiv.plan.v1.pb.rs
+++ b/crates/krishiv-plan-codec/src/proto/krishiv.plan.v1.pb.rs
@@ -834,19 +834,24 @@ pub struct Function {
     pub nullable: bool,
     #[prost(bool, tag = "9")]
     pub deterministic: bool,
-    /// A canonical operator name (`==`, `and`, ...), or a registry function.
-    #[prost(oneof = "function::Id", tags = "1, 2")]
+    /// A canonical operator name (`==`, `and`, ...), a registry function, or
+    /// a session UDF.
+    #[prost(oneof = "function::Id", tags = "1, 2, 10")]
     pub id: ::core::option::Option<function::Id>,
 }
 /// Nested message and enum types in `Function`.
 pub mod function {
-    /// A canonical operator name (`==`, `and`, ...), or a registry function.
+    /// A canonical operator name (`==`, `and`, ...), a registry function, or
+    /// a session UDF.
     #[derive(Clone, PartialEq, Eq, Hash, ::prost::Oneof)]
     pub enum Id {
         #[prost(string, tag = "1")]
         Builtin(::prost::alloc::string::String),
         #[prost(message, tag = "2")]
         Registry(super::RegistryFunction),
+        /// feature: rust_udf
+        #[prost(message, tag = "10")]
+        Udf(super::UdfFunction),
     }
 }
 /// A function of the registry, by name and registry id. A worker must run
@@ -858,6 +863,16 @@ pub struct RegistryFunction {
     #[prost(uint32, tag = "2")]
     pub id: u32,
 }
+/// A session-registered native Rust UDF, by name and implementation
+/// version. A worker must hold the same version to run the plan.
+/// feature: rust_udf
+#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
+pub struct UdfFunction {
+    #[prost(string, tag = "1")]
+    pub name: ::prost::alloc::string::String,
+    #[prost(uint64, tag = "2")]
+    pub version: u64,
+}
 /// A Spark type.
 #[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
 pub struct DataType {
diff --git a/crates/krishiv-plan-codec/tests/common/inventory.rs b/crates/krishiv-plan-codec/tests/common/inventory.rs
index c5e8be302..243c1f928 100644
--- a/crates/krishiv-plan-codec/tests/common/inventory.rs
+++ b/crates/krishiv-plan-codec/tests/common/inventory.rs
@@ -943,6 +943,38 @@ pub(crate) fn expressions() -> PhysNode {
     }
 }
 
+/// A call of a session-registered native Rust UDF (`rust_udf`): the plan
+/// references it by name and version only.
+pub(crate) fn udf_call() -> PhysNode {
+    PhysNode::Project {
+        input: boxed(scan()),
+        layout: vec![AttrId(1), AttrId(2)],
+        items: vec![ProjectItemPlan::Expr {
+            name: "u".to_owned(),
+            expr: Arc::new(Expr::new(ExprNode::Resolved(ResolvedExpr::Function(
+                ResolvedFunction {
+                    id: FunctionId::Udf {
+                        name: "my_udf".to_owned(),
+                        version: 7,
+                    },
+                    kind: FunctionKind::Scalar,
+                    args: vec![
+                        col(1, "a", DataType::Integer),
+                        lit(Literal::String("x".to_owned())),
+                    ],
+                    distinct: false,
+                    filter: None,
+                    data_type: DataType::String,
+                    nullable: true,
+                    deterministic: true,
+                },
+            )))),
+        }],
+        nullable: None,
+        subqueries: Vec::new(),
+    }
+}
+
 /// Lambda expressions and variables: a `transform` over an array column
 /// (`transform(xs, x -> x * 2)`). The array type needs `nested_types` too.
 pub(crate) fn lambda_functions() -> PhysNode {
@@ -1049,6 +1081,7 @@ pub(crate) fn cases() -> Vec<(String, PhysicalPlan)> {
         .map(|(name, node)| (name.to_owned(), plan_of(node)))
         .collect();
     out.push(("expressions".to_owned(), plan_of(expressions())));
+    out.push(("rust_udf".to_owned(), plan_of(udf_call())));
     // The expression environment flag the `legacy_statistical_aggregate`
     // feature is about: the same root as `one_row`, under a session with
     // `spark.sql.legacy.statisticalAggregate` set. With no moment aggregate
diff --git a/crates/krishiv-plan-codec/tests/features.rs b/crates/krishiv-plan-codec/tests/features.rs
index 7923b68dd..53a57e6c8 100644
--- a/crates/krishiv-plan-codec/tests/features.rs
+++ b/crates/krishiv-plan-codec/tests/features.rs
@@ -509,6 +509,76 @@ fn features_of_refuses_what_it_cannot_interpret() {
     );
 }
 
+#[test]
+fn only_udf_plans_need_rust_udf_and_every_expression_position_counts() {
+    // Negative: no inventory case but `rust_udf` uses it, and the
+    // `expressions` case (a registry call) does not.
+    for (name, plan) in cases() {
+        if name == "rust_udf" {
+            assert!(plan_features(&plan).contains(&Feature::RustUdf), "{name}");
+        } else {
+            assert!(
+                !plan_features(&plan).contains(&Feature::RustUdf),
+                "{name} must not need rust_udf"
+            );
+        }
+    }
+    // The UDF expression of the inventory case, reused in every position
+    // holding an expression.
+    let udf_expr = match inventory::udf_call() {
+        PhysNode::Project { items, .. } => match &items[..] {
+            [krishiv_exec::physical::ProjectItemPlan::Expr { expr, .. }] => {
+                std::sync::Arc::clone(expr)
+            }
+            _ => panic!("inventory udf_call holds one expression"),
+        },
+        _ => panic!("inventory udf_call is a project"),
+    };
+    let builtin_expr = inventory::predicate();
+    // A UDF in a filter predicate needs the feature; a built-in does not.
+    for (predicate, wants) in [(&udf_expr, true), (&builtin_expr, false)] {
+        let plan = plan_of(PhysNode::Filter {
+            input: Box::new(PhysNode::OneRow),
+            layout: Vec::new(),
+            predicate: std::sync::Arc::clone(predicate),
+            subqueries: Vec::new(),
+        });
+        assert_eq!(plan_features(&plan).contains(&Feature::RustUdf), wants);
+    }
+    // A UDF in a scan's pushed filter needs the feature; a built-in does not.
+    for (predicate, wants) in [(&udf_expr, true), (&builtin_expr, false)] {
+        let mut scan = inventory::table_scan();
+        scan.filter = Some(krishiv_exec::physical::ScanFilter {
+            layout: vec![krishiv_plan::AttrId(1)],
+            predicate: std::sync::Arc::clone(predicate),
+            exact: true,
+        });
+        let plan = plan_of(PhysNode::Scan(scan));
+        assert_eq!(plan_features(&plan).contains(&Feature::RustUdf), wants);
+    }
+    // A UDF in a join residual needs the feature; a built-in does not.
+    for (conjunct, wants) in [(&udf_expr, true), (&builtin_expr, false)] {
+        let residual = krishiv_exec::physical::Residual {
+            layout: vec![krishiv_plan::AttrId(1)],
+            conjuncts: vec![std::sync::Arc::clone(conjunct)],
+        };
+        let plan = plan_of(PhysNode::HashJoin(krishiv_exec::physical::HashJoinPlan {
+            probe: Box::new(PhysNode::OneRow),
+            build: Box::new(PhysNode::OneRow),
+            join_type: krishiv_exec::JoinType::Inner,
+            probe_keys: Vec::new(),
+            build_keys: Vec::new(),
+            null_safe: Vec::new(),
+            residual: Some(residual),
+            single_match: false,
+            distinct_build: false,
+            runtime_filters: Vec::new(),
+            distribution: krishiv_exec::physical::JoinDistribution::Broadcast,
+        }));
+        assert_eq!(plan_features(&plan).contains(&Feature::RustUdf), wants);
+    }
+}
+
 #[test]
 fn nested_types_need_their_feature() {
     let m = message("nested_types");
@@ -696,3 +766,32 @@ fn an_unknown_hash_scheme_is_corrupt() {
     assert_eq!(hashed, 1);
     corrupt(&m, "an unknown hash scheme");
 }
+
+/// A `Subquery` expression's `IN` values are entered when scanning for UDF
+/// calls, so a UDF hiding there still needs the feature.
+#[test]
+fn subquery_in_values_with_a_udf_need_rust_udf() {
+    use krishiv_plan::{Expr, ExprNode, SubqueryKind};
+    let udf_expr = match inventory::udf_call() {
+        krishiv_exec::physical::PhysNode::Project { items, .. } => match &items[..] {
+            [krishiv_exec::physical::ProjectItemPlan::Expr { expr, .. }] => {
+                std::sync::Arc::clone(expr)
+            }
+            _ => panic!("inventory udf_call holds one expression"),
+        },
+        _ => panic!("inventory udf_call is a project"),
+    };
+    let subquery = std::sync::Arc::new(Expr::new(ExprNode::Subquery {
+        kind: SubqueryKind::In(vec![std::sync::Arc::clone(&udf_expr)]),
+        plan: std::sync::Arc::new(krishiv_plan::LogicalPlan::new(
+            krishiv_plan::PlanNode::OneRowRelation,
+        )),
+    }));
+    let plan = plan_of(krishiv_exec::physical::PhysNode::Filter {
+        input: Box::new(krishiv_exec::physical::PhysNode::OneRow),
+        layout: Vec::new(),
+        predicate: subquery,
+        subqueries: Vec::new(),
+    });
+    assert!(plan_features(&plan).contains(&Feature::RustUdf));
+}
diff --git a/crates/krishiv-plan-codec/tests/golden/rust_udf/rust_udf.bin b/crates/krishiv-plan-codec/tests/golden/rust_udf/rust_udf.bin
new file mode 100644
index 000000000..dada93c77
Binary files /dev/null and b/crates/krishiv-plan-codec/tests/golden/rust_udf/rust_udf.bin differ
diff --git a/crates/krishiv-plan-codec/tests/roundtrip.rs b/crates/krishiv-plan-codec/tests/roundtrip.rs
index c75ba7ae6..44fa0047b 100644
--- a/crates/krishiv-plan-codec/tests/roundtrip.rs
+++ b/crates/krishiv-plan-codec/tests/roundtrip.rs
@@ -429,6 +429,7 @@ fn readers_that_predate_features_still_refuse_what_they_cannot_read() {
             n if n.starts_with("expand") => 5,
             // A feature added after the freeze: above every frozen version.
             "window_group_limit"
+            | "rust_udf"
             | "nested_types"
             | "struct_field"
             | "lambda_functions"
diff --git a/crates/krishiv-plan/Cargo.toml b/crates/krishiv-plan/Cargo.toml
index 1bc93f90a..210cceb1c 100644
--- a/crates/krishiv-plan/Cargo.toml
+++ b/crates/krishiv-plan/Cargo.toml
@@ -19,6 +19,8 @@ krishiv-functions = { path = "../krishiv-functions" }
 krishiv-io = { path = "../krishiv-io" }
 # Spark's decimal result types, shared with the kernels that compute them.
 krishiv-kernels = { path = "../krishiv-kernels" }
+# Session UDFs, for constant folding through the registry.
+krishiv-udf-sdk = { path = "../krishiv-udf-sdk" }
 krishiv-types = { path = "../krishiv-types" }
 thiserror.workspace = true
 twox-hash = { workspace = true, features = ["xxhash3_128"] }
diff --git a/crates/krishiv-plan/src/analyzer/analytics.rs b/crates/krishiv-plan/src/analyzer/analytics.rs
index 42a641113..59ca59fd7 100644
--- a/crates/krishiv-plan/src/analyzer/analytics.rs
+++ b/crates/krishiv-plan/src/analyzer/analytics.rs
@@ -39,8 +39,8 @@ use super::ops::col_expr;
 use super::resolve::{Attr, Env, Rel, Resolver};
 use super::{AnalysisError, ArgType};
 use crate::{
-    BoundColumn, CastMode, Expr, ExprNode, FunctionCall, FunctionKind, Grouping, Literal,
-    LogicalPlan, Origin, PlanNode, ResolvedExpr,
+    BoundColumn, CastMode, Expr, ExprNode, FunctionCall, FunctionId, FunctionKind, Grouping,
+    Literal, LogicalPlan, Origin, PlanNode, ResolvedExpr,
 };
 
 /// The most grouping expressions one `GROUP BY` takes: the grouping id is a
@@ -156,7 +156,8 @@ pub(super) fn reject_grouping_calls(exprs: &[Arc<Expr>]) -> Result<(), AnalysisE
         if !seen.insert(Arc::as_ptr(&x) as usize) {
             continue;
         }
-        if matches!(&x.node, ExprNode::Function(f) if GroupingFn::from_name(&f.name).is_some()) {
+        if matches!(&x.node, ExprNode::Function(f) if f.unqualified().is_some_and(|n| GroupingFn::from_name(n).is_some()))
+        {
             return Err(AnalysisError::new(
                 UnsupportedGroupingExpression {},
                 Origin::UNKNOWN,
@@ -637,7 +638,10 @@ impl Resolver<'_> {
                 return self.retype(rebuilt, env);
             }
             ExprNode::Subquery { .. } => return Ok(Arc::clone(e)),
-            ExprNode::Function(f) if GroupingFn::from_name(&f.name).is_some() => {
+            ExprNode::Function(f)
+                if f.unqualified()
+                    .is_some_and(|n| GroupingFn::from_name(n).is_some()) =>
+            {
                 return self.grouping_value(f, an, env, memo);
             }
             ExprNode::Resolved(ResolvedExpr::Alias { expr, output }) => {
@@ -675,10 +679,23 @@ impl Resolver<'_> {
         let origin = e.origin;
         match &e.node {
             ExprNode::Resolved(ResolvedExpr::Function(f)) if !has_subquery(&e) => {
+                // Rebind by a name that resolves to the same function: a
+                // bare name finds the built-in first (the search path), so
+                // a session UDF rebinds qualified (`system.session.f`) while
+                // built-ins rebind bare, as before. Without the qualifier
+                // `SELECT session.upper(s) ... GROUP BY ROLLUP(s)` would
+                // silently run the built-in `upper` over the copy.
+                let (name, qualifier) = match &f.id {
+                    FunctionId::Udf { name, .. } => (
+                        name.clone(),
+                        vec!["system".to_owned(), "session".to_owned()],
+                    ),
+                    _ => (f.id.name().to_owned(), Vec::new()),
+                };
                 let call = Arc::new(
                     Expr::new(ExprNode::Function(FunctionCall {
-                        name: f.id.name().to_owned(),
-                        qualifier: Vec::new(),
+                        name,
+                        qualifier,
                         arg_names: Vec::new(),
                         args: f.args.clone(),
                         distinct: f.distinct,
@@ -718,7 +735,7 @@ impl Resolver<'_> {
             None => literal(Literal::Long(0)),
         };
         let positions: Vec<Option<usize>> = f.args.iter().map(|a| an.position(a, memo)).collect();
-        match GroupingFn::from_name(&f.name) {
+        match f.unqualified().and_then(GroupingFn::from_name) {
             Some(GroupingFn::GroupingId) => {
                 let exact = positions.len() == n
                     && positions.iter().enumerate().all(|(i, p)| *p == Some(i));
diff --git a/crates/krishiv-plan/src/analyzer/bind.rs b/crates/krishiv-plan/src/analyzer/bind.rs
index 6eb44ec7b..31a7baf79 100644
--- a/crates/krishiv-plan/src/analyzer/bind.rs
+++ b/crates/krishiv-plan/src/analyzer/bind.rs
@@ -242,8 +242,37 @@ fn check_function(
     origin: Origin,
 ) -> Result<(), AnalysisError> {
     // `builtin.f` / `system.builtin.f` (case-insensitively) resolve to the
-    // builtin function; any other qualifier is an unresolved routine.
+    // builtin function; `session.f` / `system.session.f` reach a session
+    // UDF only; any other qualifier is an unresolved routine.
     let (parts, builtin) = qualified_parts(f, &search_path(ctx), origin)?;
+    // A session-qualified call resolves through the full parts (UDFs only).
+    if is_session_qualifier(&f.qualifier) {
+        let named = f.arg_names.iter().any(Option::is_some);
+        let registry = ctx.functions.lookup(&parts, ctx.profile);
+        if matches!(registry, FunctionLookup::NotFound) {
+            return Err(AnalysisError::new(
+                UnresolvedRoutine {
+                    routine_name: quoted(&parts),
+                    search_path: search_path(ctx),
+                },
+                origin,
+            ));
+        }
+        if named && super::builtins::named_signature(&f.name).is_none() {
+            return Err(AnalysisError::new(
+                NamedParametersNotSupported {
+                    function_name: quoted(&parts),
+                },
+                origin,
+            ));
+        }
+        return match registry {
+            FunctionLookup::KnownUnsupported => {
+                Err(unsupported(format!("function {}", parts.join(".")), origin))
+            }
+            _ => Ok(()),
+        };
+    }
     let name = builtin.as_deref().unwrap_or(&f.name);
     let named = f.arg_names.iter().any(Option::is_some);
     // The canonical operators exist in every profile; the analyzer types
@@ -262,9 +291,18 @@ fn check_function(
                 .lookup(std::slice::from_ref(&name.to_owned()), ctx.profile),
         )
     };
+    // A builtin-qualified call (`builtin.f`, `system.builtin.f`) reaches
+    // built-ins only: a session UDF of the same name stays unresolved.
+    let unresolved = matches!(&registry, Some(FunctionLookup::NotFound) | None)
+        || (builtin.is_some()
+            && matches!(
+                &registry,
+                Some(FunctionLookup::Found(entry))
+                    if matches!(entry.id, crate::FunctionId::Udf { .. })
+            ));
     // Unknown functions fail before any named-argument check (Spark never
     // reaches a builder for them).
-    if !builtin_op && !grouping && matches!(&registry, Some(FunctionLookup::NotFound) | None) {
+    if !builtin_op && !grouping && unresolved {
         return Err(AnalysisError::new(
             UnresolvedRoutine {
                 routine_name: quoted(&parts),
@@ -296,9 +334,27 @@ fn check_function(
     }
 }
 
+/// Whether `qualifier` names the built-in catalog (`builtin` or
+/// `system.builtin`, case-insensitively): such a call reaches built-ins
+/// only.
+pub(super) fn is_builtin_qualifier(qualifier: &[String]) -> bool {
+    matches!(qualifier, [q] if q.eq_ignore_ascii_case("builtin"))
+        || matches!(qualifier, [s, b]
+        if s.eq_ignore_ascii_case("system") && b.eq_ignore_ascii_case("builtin"))
+}
+
+/// Whether `qualifier` names a session UDF catalog (`session` or
+/// `system.session`, case-insensitively): such a call reaches UDFs only.
+pub(super) fn is_session_qualifier(qualifier: &[String]) -> bool {
+    matches!(qualifier, [q] if q.eq_ignore_ascii_case("session"))
+        || matches!(qualifier, [s, q]
+        if s.eq_ignore_ascii_case("system") && q.eq_ignore_ascii_case("session"))
+}
+
 /// The routine a call names: every part as written (`parts`), and the
 /// builtin name when the qualifier is `builtin` or `system.builtin`
-/// (case-insensitively). Any other qualifier is `UNRESOLVED_ROUTINE`.
+/// (case-insensitively). A session qualifier (`session`, `system.session`)
+/// carries no builtin name; any other qualifier is `UNRESOLVED_ROUTINE`.
 pub(super) fn qualified_parts(
     f: &crate::FunctionCall,
     search_path: &str,
@@ -309,10 +365,10 @@ pub(super) fn qualified_parts(
     if f.qualifier.is_empty() {
         return Ok((parts, None));
     }
-    let builtin = matches!(f.qualifier.as_slice(), [q] if q.eq_ignore_ascii_case("builtin"))
-        || matches!(f.qualifier.as_slice(), [s, b]
-        if s.eq_ignore_ascii_case("system") && b.eq_ignore_ascii_case("builtin"));
-    if !builtin {
+    if is_session_qualifier(&f.qualifier) {
+        return Ok((parts, None));
+    }
+    if !is_builtin_qualifier(&f.qualifier) {
         return Err(AnalysisError::new(
             UnresolvedRoutine {
                 routine_name: quoted(&parts),
diff --git a/crates/krishiv-plan/src/analyzer/catalog.rs b/crates/krishiv-plan/src/analyzer/catalog.rs
index 11df77840..b4b2d7df2 100644
--- a/crates/krishiv-plan/src/analyzer/catalog.rs
+++ b/crates/krishiv-plan/src/analyzer/catalog.rs
@@ -190,10 +190,12 @@ pub enum FunctionLookup {
 
 /// The function registry: built-in functions resolve in-process, so the
 /// lookup is synchronous. It is not asked about the canonical operators
-/// ([`crate::Builtin`] names).
+/// ([`crate::Builtin`] names). Registries hosting session UDFs also answer
+/// [`FunctionRegistry::resolve_udf`].
 pub trait FunctionRegistry: Send + Sync {
     /// The function named by `name`'s parts (as written, case-insensitive;
-    /// one part for a built-in, more for a qualified name) in `profile`.
+    /// one part for a bare built-in, more for a qualified name) in
+    /// `profile`.
     fn lookup(&self, name: &[String], profile: SparkProfile) -> FunctionLookup;
     /// Whether Spark analyzes the built-in `name` (case-insensitive) as
     /// deterministic: `None` when the registry does not know. Inline
@@ -202,6 +204,16 @@ pub trait FunctionRegistry: Send + Sync {
     fn spark_deterministic(&self, _name: &str) -> Option<bool> {
         None
     }
+    /// The session UDF named `name` (already lower-case) at `version`, for
+    /// constant folding: `None` when the registry hosts no UDFs, or none
+    /// at that name and version. The default has none.
+    fn resolve_udf(
+        &self,
+        _name: &str,
+        _version: u32,
+    ) -> Option<Arc<dyn krishiv_udf_sdk::ScalarUdf>> {
+        None
+    }
     /// Changes whenever a lookup could answer differently (temporary and
     /// session functions); part of the context fingerprint.
     fn version(&self) -> u64;
@@ -596,3 +608,18 @@ impl Catalog for MemoryCatalog {
         Box::pin(std::future::ready(Ok(found)))
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::super::BuiltinFunctions;
+    use super::FunctionRegistry;
+
+    #[test]
+    fn registries_without_udfs_resolve_none() {
+        // The default `resolve_udf`: registries hosting no UDFs answer `None`,
+        // so constant folding leaves UDF calls alone.
+        let builtins = BuiltinFunctions::new();
+        assert!(builtins.resolve_udf("my_udf", 1).is_none());
+        assert!(builtins.resolve_udf("upper", 2).is_none());
+    }
+}
diff --git a/crates/krishiv-plan/src/analyzer/exprs.rs b/crates/krishiv-plan/src/analyzer/exprs.rs
index e1880e706..9ba9974bb 100644
--- a/crates/krishiv-plan/src/analyzer/exprs.rs
+++ b/crates/krishiv-plan/src/analyzer/exprs.rs
@@ -263,6 +263,16 @@ impl Conditional {
     }
 }
 
+/// Whether `entry` is a built-in (a canonical operator or a registry
+/// function), rather than a session UDF. Every special-cased built-in path
+/// (`assert_true`'s default message, the `Conditional` rewrites, `ntile`'s
+/// folding) goes through this one rule: built-ins win over a same-name
+/// session UDF for unqualified names, and a qualified call to the session
+/// UDF reaches the UDF.
+fn is_builtin_entry(entry: &FunctionEntry) -> bool {
+    !matches!(entry.id, FunctionId::Udf { .. })
+}
+
 /// Whether `t` is a numeric type.
 fn is_conditional_numeric(t: &DataType) -> bool {
     matches!(
@@ -674,12 +684,20 @@ impl Resolver<'_> {
                     // A lambda binds where it is used: a higher-order
                     // call binds its array and lambda children itself
                     // (see `hof`), while a lambda anywhere else is no
-                    // higher-order call's argument.
+                    // higher-order call's argument. Only unqualified and
+                    // builtin-qualified calls take the higher-order path:
+                    // a session-qualified UDF named like one (`session.filter`,
+                    // ...) runs the UDF.
+                    let hof = |f: &FunctionCall| {
+                        (f.unqualified().is_some()
+                            || super::bind::is_builtin_qualifier(&f.qualifier))
+                        .then(|| super::hof::Hof::of(&f.name))
+                        .flatten()
+                    };
                     if let ExprNode::Function(f) = &x.node
-                        && (super::hof::Hof::of(&f.name).is_some()
-                            || super::hof::has_direct_lambda(f))
+                        && (hof(f).is_some() || super::hof::has_direct_lambda(f))
                     {
-                        let Some(h) = super::hof::Hof::of(&f.name) else {
+                        let Some(h) = hof(f) else {
                             return Err(super::hof::not_higher_order(&f.name, x.origin));
                         };
                         let kids = self.child_ctx(&x, ctx);
@@ -753,10 +771,24 @@ impl Resolver<'_> {
 
     pub(super) fn is_aggregate(&self, e: &Expr) -> bool {
         match &e.node {
-            ExprNode::Function(f) => matches!(
-                self.ctx.functions.lookup(std::slice::from_ref(&f.name), self.ctx.profile),
-                FunctionLookup::Found(entry) if entry.kind == FunctionKind::Aggregate
-            ),
+            ExprNode::Function(f) => {
+                // A session-qualified call (`session.f`) resolves through
+                // its full qualifier (UDFs only), as resolution does; any
+                // other call resolves by its bare name.
+                let name;
+                let lookup: &[String] = if super::bind::is_session_qualifier(&f.qualifier) {
+                    let mut parts = f.qualifier.clone();
+                    parts.push(f.name.clone());
+                    name = parts;
+                    &name
+                } else {
+                    std::slice::from_ref(&f.name)
+                };
+                matches!(
+                    self.ctx.functions.lookup(lookup, self.ctx.profile),
+                    FunctionLookup::Found(entry) if entry.kind == FunctionKind::Aggregate
+                )
+            }
             ExprNode::Resolved(ResolvedExpr::Function(f)) => f.kind == FunctionKind::Aggregate,
             _ => false,
         }
@@ -774,7 +806,9 @@ impl Resolver<'_> {
         if !f.args.iter().any(|a| matches!(a.node, ExprNode::Star(_))) {
             return Ok(None);
         }
-        let count_star = f.name.eq_ignore_ascii_case("count")
+        let count_star = f
+            .unqualified()
+            .is_some_and(|n| n.eq_ignore_ascii_case("count"))
             && matches!(&f.args[..], [a] if matches!(&a.node, ExprNode::Star(s) if s.qualifier.is_empty() && s.plan_id.is_none()));
         let struct_star =
             f.name.eq_ignore_ascii_case("struct") || f.name.eq_ignore_ascii_case("named_struct");
@@ -1259,14 +1293,21 @@ impl Resolver<'_> {
                     return Err(super::windows::window_in_filter(filter, e.origin));
                 }
                 // `builtin.f` / `system.builtin.f` resolve to the builtin;
+                // `session.f` / `system.session.f` reach a session UDF only;
                 // any other qualifier is an unresolved routine.
+                // Grouping functions are never qualified.
                 let (parts, builtin) = qualified_parts(f, &self.b.search_path, e.origin)?;
+                let session_qualified = super::bind::is_session_qualifier(&f.qualifier);
                 let lookup_name = builtin.as_deref().unwrap_or(&f.name);
                 // A call of a function with a named-parameter signature is
                 // rearranged into positional order (Spark's
                 // `FunctionBuilderBase` rearrangement), filling defaults; any
                 // other call with named arguments is unsupported.
-                let signature = named_signature(lookup_name);
+                let signature = if session_qualified {
+                    None
+                } else {
+                    named_signature(lookup_name)
+                };
                 let mut kids = kids.to_vec();
                 if signature.is_some() {
                     let filter = kids.get(n).cloned();
@@ -1288,10 +1329,10 @@ impl Resolver<'_> {
                     ));
                 }
                 let n = kids.len() - usize::from(f.filter.is_some());
-                if let Some(which) = GroupingFn::from_name(lookup_name) {
+                if !session_qualified && let Some(which) = GroupingFn::from_name(lookup_name) {
                     return self.grouping_call(which, e, &kids[..n], cx);
                 }
-                if let Some(op) = builtin_op(lookup_name, n) {
+                if !session_qualified && let Some(op) = builtin_op(lookup_name, n) {
                     // `ILIKE` and `LIKE|ILIKE ANY|SOME|ALL` are rewritten to
                     // the calls they denote, keeping Spark's display name.
                     if op == Builtin::ILike {
@@ -1302,25 +1343,60 @@ impl Resolver<'_> {
                     }
                     return self.operator_call(op, e.origin, &kids[..n]);
                 }
-                let entry = match self.ctx.functions.lookup(
-                    std::slice::from_ref(&lookup_name.to_owned()),
-                    self.ctx.profile,
-                ) {
-                    FunctionLookup::Found(entry) => entry,
-                    FunctionLookup::KnownUnsupported => {
-                        return Err(unsupported(
-                            format!("function {}", parts.join(".")),
-                            e.origin,
-                        ));
+                let entry = if session_qualified {
+                    match self.ctx.functions.lookup(&parts, self.ctx.profile) {
+                        FunctionLookup::Found(entry) => entry,
+                        FunctionLookup::KnownUnsupported => {
+                            return Err(unsupported(
+                                format!("function {}", parts.join(".")),
+                                e.origin,
+                            ));
+                        }
+                        FunctionLookup::NotFound => {
+                            return Err(AnalysisError::new(
+                                UnresolvedRoutine {
+                                    routine_name: quoted(&parts),
+                                    search_path: self.b.search_path.clone(),
+                                },
+                                e.origin,
+                            ));
+                        }
                     }
-                    FunctionLookup::NotFound => {
-                        return Err(AnalysisError::new(
-                            UnresolvedRoutine {
-                                routine_name: quoted(&parts),
-                                search_path: self.b.search_path.clone(),
-                            },
-                            e.origin,
-                        ));
+                } else {
+                    match self.ctx.functions.lookup(
+                        std::slice::from_ref(&lookup_name.to_owned()),
+                        self.ctx.profile,
+                    ) {
+                        // A builtin-qualified call (`builtin.f`,
+                        // `system.builtin.f`) reaches built-ins only: a
+                        // session UDF of the same name stays unresolved.
+                        FunctionLookup::Found(entry)
+                            if builtin.is_some() && matches!(entry.id, FunctionId::Udf { .. }) =>
+                        {
+                            return Err(AnalysisError::new(
+                                UnresolvedRoutine {
+                                    routine_name: quoted(&parts),
+                                    search_path: self.b.search_path.clone(),
+                                },
+                                e.origin,
+                            ));
+                        }
+                        FunctionLookup::Found(entry) => entry,
+                        FunctionLookup::KnownUnsupported => {
+                            return Err(unsupported(
+                                format!("function {}", parts.join(".")),
+                                e.origin,
+                            ));
+                        }
+                        FunctionLookup::NotFound => {
+                            return Err(AnalysisError::new(
+                                UnresolvedRoutine {
+                                    routine_name: quoted(&parts),
+                                    search_path: self.b.search_path.clone(),
+                                },
+                                e.origin,
+                            ));
+                        }
                     }
                 };
                 if !window_fn {
@@ -1330,7 +1406,10 @@ impl Resolver<'_> {
                 // contributes its name, a struct field its field name), so a
                 // call with any named child becomes `named_struct(name, ...)`
                 // with `colN` defaults; all-default calls stay `struct`.
-                if entry.id.name() == "struct"
+                // Only for the built-in: a qualified session UDF named
+                // `struct` runs the UDF.
+                if is_builtin_entry(&entry)
+                    && entry.id.name() == "struct"
                     && let Some(rewritten) = self.struct_names(f, &kids[..n], e.origin)
                 {
                     // The children are bound already, and rebinding a
@@ -1354,72 +1433,91 @@ impl Resolver<'_> {
                 // `assert_true(c)` is `assert_true(c, '<c>' is not true!)`:
                 // Spark's constructor materializes the default message, so
                 // the schema names it (`assert_true(true, 'true' is not
-                // true!)`) and the kernel raises it.
+                // true!)`) and the kernel raises it. Only for the built-in:
+                // a qualified session UDF named `assert_true` takes its
+                // arguments as written.
+                // Only for built-ins: a qualified session UDF named `assert_true`
+                // takes its arguments as written, as do the other built-in
+                // constructors below and the conditional rewrites.
                 let mut owned: Vec<Bound>;
-                let (kids, n) = if entry.id.name() == "assert_true" && n == 1 {
-                    owned = kids.clone();
-                    owned.insert(
-                        1,
-                        assert_message(&owned[0], e.origin, self.ctx.conf.session_zone),
-                    );
-                    (&owned[..], 2)
-                } else if entry.id.name() == "mask" && (1..5).contains(&n) {
-                    owned = kids[..n].to_vec();
-                    owned.extend(MASK_DEFAULTS.iter().skip(n - 1).map(|d| match d {
-                        Some(text) => default_argument(
-                            Literal::String((*text).to_owned()),
-                            DataType::String,
+                let (kids, n) =
+                    if is_builtin_entry(&entry) && entry.id.name() == "assert_true" && n == 1 {
+                        owned = kids.clone();
+                        owned.insert(
+                            1,
+                            assert_message(&owned[0], e.origin, self.ctx.conf.session_zone),
+                        );
+                        (&owned[..], 2)
+                    } else if is_builtin_entry(&entry)
+                        && entry.id.name() == "mask"
+                        && (1..5).contains(&n)
+                    {
+                        owned = kids[..n].to_vec();
+                        owned.extend(MASK_DEFAULTS.iter().skip(n - 1).map(|d| match d {
+                            Some(text) => default_argument(
+                                Literal::String((*text).to_owned()),
+                                DataType::String,
+                                false,
+                                e.origin,
+                            ),
+                            None => default_argument(
+                                Literal::Null(Some(DataType::String)),
+                                DataType::String,
+                                true,
+                                e.origin,
+                            ),
+                        }));
+                        if let Some(filter) = kids.get(n) {
+                            owned.push(filter.clone());
+                        }
+                        (&owned[..], 5)
+                    } else if is_builtin_entry(&entry)
+                        && matches!(entry.id.name(), "locate" | "position")
+                        && n == 2
+                    {
+                        // `locate(sub, str)` is `locate(sub, str, 1)`.
+                        owned = kids[..n].to_vec();
+                        owned.push(default_argument(
+                            Literal::Integer(1),
+                            DataType::Integer,
                             false,
                             e.origin,
-                        ),
-                        None => default_argument(
-                            Literal::Null(Some(DataType::String)),
-                            DataType::String,
-                            true,
-                            e.origin,
-                        ),
-                    }));
-                    if let Some(filter) = kids.get(n) {
-                        owned.push(filter.clone());
-                    }
-                    (&owned[..], 5)
-                } else if matches!(entry.id.name(), "locate" | "position") && n == 2 {
-                    // `locate(sub, str)` is `locate(sub, str, 1)`.
-                    owned = kids[..n].to_vec();
-                    owned.push(default_argument(
-                        Literal::Integer(1),
-                        DataType::Integer,
-                        false,
-                        e.origin,
-                    ));
-                    if let Some(filter) = kids.get(n) {
-                        owned.push(filter.clone());
-                    }
-                    (&owned[..], 3)
-                } else if entry.id.name() == "named_struct" && n > 0 {
-                    owned = kids.clone();
-                    // A foldable name that is not a literal becomes one, so
-                    // the executor binds it (the result rule already read it
-                    // folded; the shown form keeps the written argument for
-                    // error quotes).
-                    for k in owned.iter_mut().step_by(2) {
-                        if !matches!(k.expr.node, ExprNode::Literal(_))
-                            && let Some(Constant::String(name)) =
-                                self.fold(&k.expr, self.ctx.conf.ansi)
-                        {
-                            let lit = Arc::new(
-                                Expr::new(ExprNode::Literal(Literal::String(name)))
-                                    .with_origin(k.expr.origin),
-                            );
-                            k.shown = Some(Arc::clone(&k.expr));
-                            k.expr = lit;
+                        ));
+                        if let Some(filter) = kids.get(n) {
+                            owned.push(filter.clone());
                         }
-                    }
-                    (&owned[..], n)
-                } else {
-                    (&kids[..], n)
-                };
-                if let Some(which) = Conditional::of(lookup_name) {
+                        (&owned[..], 3)
+                    } else if is_builtin_entry(&entry) && entry.id.name() == "named_struct" && n > 0
+                    {
+                        owned = kids.clone();
+                        // A foldable name that is not a literal becomes one, so
+                        // the executor binds it (the result rule already read it
+                        // folded; the shown form keeps the written argument for
+                        // error quotes).
+                        for k in owned.iter_mut().step_by(2) {
+                            if !matches!(k.expr.node, ExprNode::Literal(_))
+                                && let Some(Constant::String(name)) =
+                                    self.fold(&k.expr, self.ctx.conf.ansi)
+                            {
+                                let lit = Arc::new(
+                                    Expr::new(ExprNode::Literal(Literal::String(name)))
+                                        .with_origin(k.expr.origin),
+                                );
+                                k.shown = Some(Arc::clone(&k.expr));
+                                k.expr = lit;
+                            }
+                        }
+                        (&owned[..], n)
+                    } else {
+                        (&kids[..], n)
+                    };
+                // Only for built-ins: a qualified session UDF named like a
+                // conditional (`session.nvl`, `system.session.nvl`, ...) runs
+                // the UDF, while a bare `nvl` runs the built-in (which wins
+                // the search path).
+                if is_builtin_entry(&entry)
+                    && let Some(which) = Conditional::of(lookup_name)
+                {
                     return self.conditional_call(which, &entry, e, f, kids);
                 }
                 let (mut call_kids, ty) = self.typed_call(&entry, e, &kids[..n])?;
@@ -1427,15 +1525,20 @@ impl Resolver<'_> {
                 // The registry lookup is ASCII case-insensitive and
                 // `id.name()` is the canonical lower-case name, so a
                 // case-variant call (`SCHEMA_OF_CSV`) resolves here too.
-                let is_schema_of_csv = entry.id.name() == "schema_of_csv";
-                if lookup_name.eq_ignore_ascii_case("mask") {
+                // Only for the built-in: a qualified session UDF of the
+                // same name runs the UDF.
+                let is_schema_of_csv =
+                    is_builtin_entry(&entry) && entry.id.name() == "schema_of_csv";
+                if is_builtin_entry(&entry) && entry.id.name() == "mask" {
                     self.check_mask_replacements(lookup_name, &kids[..n], &call_kids[..n])?;
                 }
                 let data_type = ty.data_type.clone().unwrap_or(DataType::Null);
                 call_kids.extend(kids.get(n).cloned());
                 // `typeof(x)` is Spark's `RuntimeReplaceable`; its type
-                // name is known once the call is typed.
-                let is_typeof = entry.id.name() == "typeof";
+                // name is known once the call is typed. Only for the
+                // built-in: a qualified session UDF named `typeof` runs
+                // the UDF.
+                let is_typeof = is_builtin_entry(&entry) && entry.id.name() == "typeof";
                 let call = ResolvedFunction {
                     id: entry.id,
                     kind: entry.kind,
@@ -1447,7 +1550,7 @@ impl Resolver<'_> {
                     deterministic: entry.deterministic,
                 };
                 let expr = rebuilt(ExprNode::Resolved(ResolvedExpr::Function(call)));
-                let shown = self.call_shown(lookup_name, &expr, kids, &call_kids);
+                let shown = self.call_shown(&parts, &expr, kids, &call_kids);
                 // `typeof(x)` is Spark's `RuntimeReplaceable`: the analyzer
                 // replaces it with the type name literal, keeping the call
                 // as the shown form (the executor gets no type logic).
@@ -1674,14 +1777,16 @@ impl Resolver<'_> {
 
     /// `ntile`'s bucket count as the literal it folds to (`ntile(1 + 1)`):
     /// the window operator reads a literal. The rule above checked it is an
-    /// `int` constant.
+    /// `int` constant. Only for the built-in: a session UDF named `ntile`
+    /// keeps its arguments as written.
     #[inline(never)]
     fn folded_ntile(
         entry: &FunctionEntry,
         constants: &[Option<Constant>],
         mut kids: Vec<Bound>,
     ) -> Vec<Bound> {
-        if entry.id.name() == "ntile"
+        if is_builtin_entry(entry)
+            && entry.id.name() == "ntile"
             && let (Some(Some(Constant::Integral(n))), Some(k)) =
                 (constants.first(), kids.first_mut())
             && let Ok(n) = i32::try_from(*n)
@@ -1750,7 +1855,7 @@ impl Resolver<'_> {
     #[inline(never)]
     fn call_shown(
         &self,
-        name: &str,
+        name: &[String],
         expr: &Expr,
         kids: &[Bound],
         cast: &[Bound],
@@ -1768,15 +1873,22 @@ impl Resolver<'_> {
             self.ctx.conf.decimal_precision_loss,
             self.ctx.conf.map_key_dedup_last_win,
             self.ctx.profile,
+            self.ctx.conf.session_zone,
         );
-        fold::constant(e, conf, &mut self.folds.borrow_mut())
+        fold::constant(
+            e,
+            conf,
+            &mut self.folds.borrow_mut(),
+            self.ctx.functions.as_ref(),
+        )
     }
 
-    fn legacy_day_count(&self, name: &str, kids: &[Bound]) -> Option<Vec<Bound>> {
+    fn legacy_day_count(&self, name: &[String], kids: &[Bound]) -> Option<Vec<Bound>> {
+        let last = name.last().map(String::as_str).unwrap_or("");
         if self.ctx.conf.ansi
             || !["date_add", "dateadd", "date_sub"]
                 .iter()
-                .any(|n| name.eq_ignore_ascii_case(n))
+                .any(|n| last.eq_ignore_ascii_case(n))
         {
             return None;
         }
@@ -3678,14 +3790,13 @@ fn pretty_node(x: &Expr, k: &[&str], zone: Option<i32>) -> String {
             } else {
                 format!("{}.{name}", qualifier.join("."))
             };
-            call(
-                &qualified,
-                Builtin::from_name(name),
-                *distinct,
-                k,
-                Some(arg_names),
-                None,
-            )
+            // Operators are never qualified, so only a bare name matches.
+            let op = if qualifier.is_empty() {
+                Builtin::from_name(name)
+            } else {
+                None
+            };
+            call(&qualified, op, *distinct, k, Some(arg_names), None)
         }
         // Spark's `lag`/`lead` show `input, offset, default`, and
         // `nth_value` `input, offset` then ` ignore nulls` when set.
@@ -3718,6 +3829,7 @@ fn pretty_node(x: &Expr, k: &[&str], zone: Option<i32>) -> String {
             let op = match &f.id {
                 FunctionId::Builtin(b) => Some(*b),
                 FunctionId::Registry { name, .. } => builtin_op(name, f.args.len()),
+                FunctionId::Udf { .. } => None,
             };
             let n = f.args.len().min(k.len());
             let text = call(
@@ -4280,7 +4392,89 @@ const fn frame_shape(b: &crate::FrameBound) -> u8 {
 
 #[cfg(test)]
 mod tests {
+    use std::sync::Arc;
+
+    use super::super::{Arity, Constant, ResultType};
     use super::*;
+    use super::{Bound, Resolver};
+    use crate::{
+        AttrId, BoundColumn, Expr, ExprNode, FunctionCall, FunctionId, FunctionKind, Literal,
+        ResolvedExpr,
+    };
+    use krishiv_types::DataType;
+
+    /// A `FunctionEntry` for `id`: what the session registry builds for the
+    /// built-in window function `ntile` and for a session UDF of that name.
+    fn entry(id: FunctionId) -> super::super::FunctionEntry {
+        let result: ResultType = Arc::new(|_| {
+            Ok(super::super::ArgType {
+                data_type: None,
+                nullable: true,
+            })
+        });
+        super::super::FunctionEntry {
+            id,
+            kind: FunctionKind::Scalar,
+            arity: Arity::any(),
+            inputs: super::super::Inputs::Any,
+            result,
+            deterministic: true,
+        }
+    }
+
+    /// One bound `1 + 1` argument, as `typed_call` passes it.
+    fn kid() -> Bound {
+        let one = || Arc::new(Expr::new(ExprNode::Literal(Literal::Integer(1))));
+        Bound {
+            expr: Arc::new(Expr::new(ExprNode::Function(FunctionCall {
+                name: "+".to_owned(),
+                qualifier: Vec::new(),
+                arg_names: Vec::new(),
+                args: vec![one(), one()],
+                distinct: false,
+                filter: None,
+            }))),
+            ty: super::super::ArgType {
+                data_type: Some(DataType::Integer),
+                nullable: false,
+            },
+            agg: None,
+            win: None,
+            outer: None,
+            lateral: Vec::new(),
+            shown: None,
+        }
+    }
+
+    /// `ntile`'s bucket count folds to its literal for the built-in only: a
+    /// session UDF named `ntile` keeps its arguments as written. The
+    /// difference is analyzer-level (the optimizer folds `1 + 1` either
+    /// way), so it is checked here rather than through query results.
+    #[test]
+    fn folded_ntile_only_folds_for_builtins() {
+        let constants = vec![Some(Constant::Integral(2))];
+        let builtin = entry(FunctionId::Registry {
+            name: "ntile".to_owned(),
+            id: 0,
+        });
+        let folded = Resolver::folded_ntile(&builtin, &constants, vec![kid()]);
+        assert!(
+            matches!(&folded[0].expr.node, ExprNode::Literal(Literal::Integer(2))),
+            "the built-in folds its bucket count"
+        );
+        let udf = entry(FunctionId::Udf {
+            name: "ntile".to_owned(),
+            version: 1,
+        });
+        let kept = Resolver::folded_ntile(&udf, &constants, vec![kid()]);
+        assert!(
+            matches!(
+                &kept[0].expr.node,
+                ExprNode::Function(f) if f.name == "+" && f.qualifier.is_empty()
+            ),
+            "a session UDF keeps its argument as written"
+        );
+    }
 
     /// `lambdafunction(body, arg1, ...)`: a resolved lambda variable
     /// prints as its name, like Spark's `NamedLambdaVariable`.
@@ -4366,4 +4560,53 @@ mod tests {
             "`str` `otherChar` `digitChar`"
         );
     }
+
+    /// Operators are never qualified: only a bare name matches an operator,
+    /// so `session.+` prints as written.
+    #[test]
+    fn qualified_operators_print_as_written() {
+        let qualified = Expr::new(ExprNode::Function(FunctionCall {
+            name: "+".to_owned(),
+            qualifier: vec!["session".to_owned()],
+            args: vec![
+                Arc::new(Expr::new(ExprNode::Literal(Literal::Integer(1)))),
+                Arc::new(Expr::new(ExprNode::Literal(Literal::Integer(2)))),
+            ],
+            arg_names: Vec::new(),
+            distinct: false,
+            filter: None,
+        }));
+        assert_eq!(pretty(&qualified, None), "session.+(1, 2)");
+        let bare = Expr::new(ExprNode::Function(FunctionCall {
+            name: "+".to_owned(),
+            qualifier: Vec::new(),
+            args: vec![
+                Arc::new(Expr::new(ExprNode::Literal(Literal::Integer(1)))),
+                Arc::new(Expr::new(ExprNode::Literal(Literal::Integer(2)))),
+            ],
+            arg_names: Vec::new(),
+            distinct: false,
+            filter: None,
+        }));
+        assert_eq!(pretty(&bare, None), "(1 + 2)");
+    }
+
+    /// The test helper's result rule answers typeless and nullable.
+    #[test]
+    fn test_entries_answer_without_a_type() {
+        use krishiv_functions::signature::CallTypes;
+        let call = CallTypes::new(&[], &[]);
+        for id in [
+            FunctionId::Builtin(Builtin::Add),
+            FunctionId::Udf {
+                name: "my_udf".to_owned(),
+                version: 1,
+            },
+        ] {
+            let e = entry(id);
+            let ty = (e.result)(&call).unwrap();
+            assert_eq!(ty.data_type, None);
+            assert!(ty.nullable);
+        }
+    }
 }
diff --git a/crates/krishiv-plan/src/analyzer/fold.rs b/crates/krishiv-plan/src/analyzer/fold.rs
index 171480fe6..910a94a98 100644
--- a/crates/krishiv-plan/src/analyzer/fold.rs
+++ b/crates/krishiv-plan/src/analyzer/fold.rs
@@ -49,7 +49,7 @@ use krishiv_kernels::{KernelCtx, SparkVersion};
 use krishiv_types::DataType;
 
 use super::fold_ops;
-use super::{Constant, SparkProfile};
+use super::{Constant, FunctionRegistry, SparkProfile};
 use crate::{
     Builtin, CastMode, Expr, ExprNode, FunctionId, Literal, ResolvedExpr, ResolvedFunction,
 };
@@ -61,6 +61,9 @@ pub(super) struct Conf {
     pub ansi: bool,
     /// `spark.sql.decimalOperations.allowPrecisionLoss`.
     pub decimal_loss: bool,
+    /// The session time zone as a fixed offset in seconds, when it is one.
+    /// UDFs folding over literals see it in their [`InvokeContext`](krishiv_udf_sdk::InvokeContext).
+    pub zone: Option<i32>,
     /// `spark.sql.mapKeyDedupPolicy = LAST_WIN`.
     pub map_key_dedup_last_win: bool,
     /// The kernels' context: the session's Spark line, whose error classes
@@ -75,6 +78,7 @@ impl Conf {
         decimal_loss: bool,
         map_key_dedup_last_win: bool,
         profile: SparkProfile,
+        zone: Option<i32>,
     ) -> Self {
         // The kernels model 4.0 as their oldest line; 3.5 behaves as it.
         let version = match profile {
@@ -85,6 +89,7 @@ impl Conf {
         Self {
             ansi,
             decimal_loss,
+            zone,
             map_key_dedup_last_win,
             kernel: KernelCtx::new().with_spark_version(version),
         }
@@ -97,7 +102,7 @@ type Folded = Option<Result<ArrayRef, KrishivError>>;
 
 /// What a folded node's value depends on besides the node: its address
 /// and the settings it was folded under.
-type Key = (usize, bool, bool, bool, SparkVersion);
+type Key = (usize, bool, bool, bool, SparkVersion, Option<i32>);
 
 /// The values of the expressions folded so far in one resolver pass, by
 /// node address. Folding a call folds its arguments, and `Resolver::expr`
@@ -121,14 +126,25 @@ pub(super) const fn is_literal(e: &Expr) -> bool {
 /// timestamp, which never folds here) has no [`Constant`]: it is not a
 /// value the typing rules read, so it is not a constant rather than an
 /// error, while the calls evaluated from it still fold.
-pub(super) fn constant(e: &Arc<Expr>, conf: Conf, memo: &mut Memo) -> Option<Constant> {
+///
+/// Session UDFs fold through `functions`: a deterministic scalar UDF call
+/// of literal arguments invokes its implementation here; a failure folds
+/// to [`Constant::Error`], the analyzer's raising-literal form, so the
+/// error surfaces when the plan runs the call (or when an outer function
+/// reads the value, as with built-ins).
+pub(super) fn constant(
+    e: &Arc<Expr>,
+    conf: Conf,
+    memo: &mut Memo,
+    functions: &dyn FunctionRegistry,
+) -> Option<Constant> {
     match &e.node {
         ExprNode::Literal(Literal::Null(_)) => return Some(Constant::Null),
         ExprNode::Literal(Literal::Boolean(v)) => return Some(Constant::Boolean(*v)),
         ExprNode::Literal(Literal::String(v)) => return Some(Constant::String(v.clone())),
         _ => {}
     }
-    let folded = fold(e, conf, memo)?;
+    let folded = fold(e, conf, memo, functions)?;
     let array = match folded {
         Err(e) => return Some(Constant::Error(e)),
         Ok(a) => a,
@@ -211,18 +227,23 @@ fn unsupported() -> KrishivError {
 
 /// `e` as a one-row array: `None` when it is not foldable here. Every
 /// `STEP` levels run on a fresh stack (see `Resolver::rel`).
-fn fold(e: &Arc<Expr>, conf: Conf, memo: &mut Memo) -> Folded {
+fn fold(e: &Arc<Expr>, conf: Conf, memo: &mut Memo, functions: &dyn FunctionRegistry) -> Folded {
     memo.depth += 1;
     let r = if memo.depth.is_multiple_of(STEP) {
-        on_big_stack(|| fold_on_stack(e, conf, memo)).unwrap_or(None)
+        on_big_stack(|| fold_on_stack(e, conf, memo, functions)).unwrap_or(None)
     } else {
-        fold_on_stack(e, conf, memo)
+        fold_on_stack(e, conf, memo, functions)
     };
     memo.depth -= 1;
     r
 }
 
-fn fold_on_stack(e: &Arc<Expr>, conf: Conf, memo: &mut Memo) -> Folded {
+fn fold_on_stack(
+    e: &Arc<Expr>,
+    conf: Conf,
+    memo: &mut Memo,
+    functions: &dyn FunctionRegistry,
+) -> Folded {
     if let ExprNode::Literal(l) = &e.node {
         return literal(l).map(Ok);
     }
@@ -232,21 +253,29 @@ fn fold_on_stack(e: &Arc<Expr>, conf: Conf, memo: &mut Memo) -> Folded {
         conf.decimal_loss,
         conf.map_key_dedup_last_win,
         conf.kernel.spark_version(),
+        conf.zone,
     );
     if let Some((_, hit)) = memo.map.get(&key) {
         return hit.clone();
     }
     let folded = match &e.node {
-        ExprNode::Cast { expr, to, mode: m } => fold_cast(expr, to, *m, conf, memo),
-        ExprNode::Resolved(ResolvedExpr::Function(f)) => call(f, conf, memo),
+        ExprNode::Cast { expr, to, mode: m } => fold_cast(expr, to, *m, conf, memo, functions),
+        ExprNode::Resolved(ResolvedExpr::Function(f)) => call(f, conf, memo, functions),
         _ => None,
     };
     memo.map.insert(key, (Arc::clone(e), folded.clone()));
     folded
 }
 
-fn fold_cast(expr: &Arc<Expr>, to: &DataType, m: CastMode, conf: Conf, memo: &mut Memo) -> Folded {
-    let inner = match fold(expr, conf, memo)? {
+fn fold_cast(
+    expr: &Arc<Expr>,
+    to: &DataType,
+    m: CastMode,
+    conf: Conf,
+    memo: &mut Memo,
+    functions: &dyn FunctionRegistry,
+) -> Folded {
+    let inner = match fold(expr, conf, memo, functions)? {
         // The executor reads strings through their `Utf8` carrier too.
         Ok(a) => normalized(a),
         Err(e) => return Some(Err(e)),
@@ -304,20 +333,75 @@ fn kids(
     f: &ResolvedFunction,
     conf: Conf,
     memo: &mut Memo,
+    functions: &dyn FunctionRegistry,
 ) -> Option<Vec<Result<ArrayRef, KrishivError>>> {
     // Stops at the first argument that is not foldable (a column), so a
     // deep non-constant tree costs one descent, not an evaluation.
-    f.args.iter().map(|a| fold(a, conf, memo)).collect()
+    f.args
+        .iter()
+        .map(|a| fold(a, conf, memo, functions))
+        .collect()
 }
 
-fn call(f: &ResolvedFunction, conf: Conf, memo: &mut Memo) -> Folded {
+fn call(
+    f: &ResolvedFunction,
+    conf: Conf,
+    memo: &mut Memo,
+    functions: &dyn FunctionRegistry,
+) -> Folded {
     if !f.deterministic || f.distinct || f.filter.is_some() || f.kind != FunctionKind::Scalar {
         return None;
     }
-    let kids = kids(f, conf, memo)?;
     match &f.id {
-        FunctionId::Builtin(b) => operator(*b, f, kids, conf),
-        FunctionId::Registry { name, .. } => registry(name, f, kids, conf),
+        FunctionId::Builtin(b) => {
+            let kids = kids(f, conf, memo, functions)?;
+            operator(*b, f, kids, conf)
+        }
+        FunctionId::Registry { name, .. } => {
+            let kids = kids(f, conf, memo, functions)?;
+            registry(name, f, kids, conf)
+        }
+        FunctionId::Udf { name, version } => udf(name, *version, f, conf, memo, functions),
+    }
+}
+
+/// A deterministic scalar session-UDF call of foldable arguments, invoked
+/// through the same binding execution uses. A nondeterministic UDF, a
+/// non-foldable argument, an unknown version or a failure to bind never
+/// folds; a bound call that fails folds to its error (the analyzer's
+/// raising-literal form).
+fn udf(
+    name: &str,
+    version: u32,
+    f: &ResolvedFunction,
+    conf: Conf,
+    memo: &mut Memo,
+    functions: &dyn FunctionRegistry,
+) -> Folded {
+    let udf = functions.resolve_udf(name, version)?;
+    // Folded (not syntactic) arguments, as for built-ins: casts and nested
+    // calls fold, and an argument error propagates.
+    let kids = kids(f, conf, memo, functions)?;
+    let literals = match values(kids) {
+        Ok(a) => a,
+        Err(e) => return Some(Err(e)),
+    };
+    let literals: Vec<ArrayRef> = literals.into_iter().map(normalized).collect();
+    let arg_types: Vec<ArrowType> = literals.iter().map(|a| a.data_type().clone()).collect();
+    let bound = krishiv_functions::scalar::bind_udf(
+        &udf,
+        &arg_types,
+        &f.data_type,
+        f.nullable,
+        conf.ansi,
+        conf.zone,
+    )
+    .ok()?;
+    let literals: Vec<Arg> = literals.into_iter().map(Arg::Scalar).collect();
+    match bound.invoke(&literals, 1) {
+        Ok(a) => Some(Ok(normalized(a))),
+        Err(e) if e.error_class() == ErrorClass::KrishivUnsupportedFeature => None,
+        Err(e) => Some(Err(e)),
     }
 }
 
@@ -563,12 +647,14 @@ mod tests {
     use krishiv_types::DecimalType;
 
     use super::*;
+    use crate::analyzer::{BuiltinFunctions, FunctionLookup};
 
     fn constant(e: &Expr, ansi: bool) -> Option<Constant> {
         super::constant(
             &Arc::new(e.clone()),
-            Conf::new(ansi, true, false, SparkProfile::V4_2),
+            Conf::new(ansi, true, false, SparkProfile::V4_2, None),
             &mut Memo::default(),
+            &BuiltinFunctions::new(),
         )
     }
 
@@ -820,6 +906,265 @@ mod tests {
         )
     }
 
+    fn udf(name: &str, version: u32, args: Vec<Expr>, deterministic: bool) -> Expr {
+        Expr::new(ExprNode::Resolved(ResolvedExpr::Function(
+            ResolvedFunction {
+                id: FunctionId::Udf {
+                    name: name.to_owned(),
+                    version,
+                },
+                kind: FunctionKind::Scalar,
+                args: args.into_iter().map(Arc::new).collect(),
+                distinct: false,
+                filter: None,
+                data_type: DataType::Integer,
+                nullable: true,
+                deterministic,
+            },
+        )))
+    }
+
+    /// `x + 1` over `INT`, deterministic or not, failing at version 9.
+    #[derive(Debug)]
+    struct TestUdf {
+        name: &'static str,
+        version: u32,
+        deterministic: bool,
+    }
+
+    impl krishiv_udf_sdk::ScalarUdf for TestUdf {
+        fn name(&self) -> &str {
+            self.name
+        }
+
+        fn version(&self) -> u32 {
+            self.version
+        }
+
+        fn signature(&self) -> &krishiv_udf_sdk::Signature {
+            use std::sync::OnceLock;
+            static SIG: OnceLock<krishiv_udf_sdk::Signature> = OnceLock::new();
+            SIG.get_or_init(|| {
+                krishiv_udf_sdk::Signature::Exact(vec![krishiv_udf_sdk::UdfInputType::Exact(
+                    DataType::Integer,
+                )])
+            })
+        }
+
+        fn return_field(
+            &self,
+            _: &[krishiv_udf_sdk::ArgField],
+        ) -> Result<krishiv_udf_sdk::ReturnField, krishiv_udf_sdk::UdfError> {
+            Ok(krishiv_udf_sdk::ReturnField {
+                data_type: DataType::Integer,
+                nullable: true,
+            })
+        }
+
+        fn properties(&self) -> krishiv_udf_sdk::UdfProperties {
+            krishiv_udf_sdk::UdfProperties {
+                deterministic: self.deterministic,
+                null_handling: krishiv_udf_sdk::NullHandling::Strict,
+            }
+        }
+
+        fn invoke(
+            &self,
+            args: &[krishiv_udf_sdk::UdfArg<'_>],
+            rows: usize,
+            _: &krishiv_udf_sdk::InvokeContext,
+        ) -> Result<ArrayRef, krishiv_udf_sdk::UdfError> {
+            use arrow_array::Int32Array;
+            if self.version == 9 {
+                return Err(krishiv_udf_sdk::UdfError::new("test failure"));
+            }
+            let input = args[0].array();
+            let input = input
+                .as_any()
+                .downcast_ref::<Int32Array>()
+                .ok_or_else(|| krishiv_udf_sdk::UdfError::new("needs INT"))?;
+            assert_eq!(
+                input.len(),
+                if matches!(args[0], krishiv_udf_sdk::UdfArg::Scalar(_)) {
+                    1
+                } else {
+                    rows
+                }
+            );
+            Ok(Arc::new(
+                input
+                    .iter()
+                    .map(|v| v.map(|v| v.wrapping_add(1)))
+                    .collect::<Int32Array>(),
+            ))
+        }
+    }
+
+    /// A registry hosting `TestUdf` at versions 2 (deterministic) and 3
+    /// (nondeterministic), plus a failing version 9.
+    #[derive(Debug, Default)]
+    struct TestUdfs {
+        library: krishiv_udf_sdk::UdfLibrary,
+    }
+
+    impl TestUdfs {
+        fn new() -> Self {
+            let library = krishiv_udf_sdk::UdfLibrary::new();
+            for (name, version, deterministic) in [
+                ("test_udf", 2, true),
+                ("test_udf_nondet", 3, false),
+                ("test_udf_failing", 9, true),
+            ] {
+                library
+                    .register(Arc::new(TestUdf {
+                        name,
+                        version,
+                        deterministic,
+                    }))
+                    .unwrap();
+            }
+            Self { library }
+        }
+    }
+
+    impl FunctionRegistry for TestUdfs {
+        fn lookup(&self, _name: &[String], _profile: SparkProfile) -> FunctionLookup {
+            FunctionLookup::NotFound
+        }
+
+        fn resolve_udf(
+            &self,
+            name: &str,
+            version: u32,
+        ) -> Option<Arc<dyn krishiv_udf_sdk::ScalarUdf>> {
+            self.library.get_versioned(name, version)
+        }
+
+        fn version(&self) -> u64 {
+            self.library.version()
+        }
+    }
+
+    fn fold_udf(name: &str, version: u32, deterministic: bool) -> Option<Constant> {
+        super::constant(
+            &Arc::new(udf(name, version, vec![int(41)], deterministic)),
+            Conf::new(true, true, false, SparkProfile::V4_2, None),
+            &mut Memo::default(),
+            &TestUdfs::new(),
+        )
+    }
+
+    /// A deterministic UDF call of literals folds through the binding; a
+    /// failure folds to the raising-literal form, and anything else does
+    /// not fold.
+    #[test]
+    fn udf_calls_fold_like_builtin_calls() {
+        // `test_udf@2` is deterministic: folds to its value.
+        assert_eq!(fold_udf("test_udf", 2, true), Some(Constant::Integral(42)));
+        // `test_udf_nondet@3` is nondeterministic: never folds.
+        assert_eq!(fold_udf("test_udf_nondet", 3, false), None);
+        // An unregistered version never folds.
+        assert_eq!(fold_udf("test_udf", 4, true), None);
+        // A failure folds to the raising-literal form.
+        assert_eq!(
+            class(fold_udf("test_udf_failing", 9, true)),
+            Some(ErrorClass::FailedExecuteUdf)
+        );
+        // A non-literal argument never folds.
+        let col = Expr::new(ExprNode::Column(crate::ColumnRef {
+            name: vec!["a".to_owned()],
+            plan_id: None,
+        }));
+        assert_eq!(
+            super::constant(
+                &Arc::new(udf("test_udf", 2, vec![col], true)),
+                Conf::new(true, true, false, SparkProfile::V4_2, None),
+                &mut Memo::default(),
+                &TestUdfs::new(),
+            ),
+            None
+        );
+        // A cast of a literal folds first, as for built-ins (implicit
+        // casts no longer block folding).
+        assert_eq!(
+            super::constant(
+                &Arc::new(udf(
+                    "test_udf",
+                    2,
+                    vec![cast_of(lit(Literal::Short(41)), DataType::Integer)],
+                    true
+                )),
+                Conf::new(true, true, false, SparkProfile::V4_2, None),
+                &mut Memo::default(),
+                &TestUdfs::new(),
+            ),
+            Some(Constant::Integral(42))
+        );
+        // A nested UDF call folds first too.
+        assert_eq!(
+            super::constant(
+                &Arc::new(udf(
+                    "test_udf",
+                    2,
+                    vec![udf("test_udf", 2, vec![int(41)], true)],
+                    true
+                )),
+                Conf::new(true, true, false, SparkProfile::V4_2, None),
+                &mut Memo::default(),
+                &TestUdfs::new(),
+            ),
+            Some(Constant::Integral(43))
+        );
+        // An argument that folds to an error propagates, as for built-ins.
+        assert_eq!(
+            class(super::constant(
+                &Arc::new(udf(
+                    "test_udf",
+                    2,
+                    vec![udf("test_udf_failing", 9, vec![int(41)], true)],
+                    true
+                )),
+                Conf::new(true, true, false, SparkProfile::V4_2, None),
+                &mut Memo::default(),
+                &TestUdfs::new(),
+            )),
+            Some(ErrorClass::FailedExecuteUdf)
+        );
+        // The fixtures expose their contracts directly.
+        let registry = TestUdfs::new();
+        assert!(matches!(
+            registry.lookup(&["anything".to_owned()], SparkProfile::V4_2),
+            FunctionLookup::NotFound
+        ));
+        assert!(registry.version() > 0);
+        let udf_impl = TestUdf {
+            name: "test_udf",
+            version: 2,
+            deterministic: true,
+        };
+        assert_eq!(krishiv_udf_sdk::ScalarUdf::name(&udf_impl), "test_udf");
+        assert_eq!(krishiv_udf_sdk::ScalarUdf::version(&udf_impl), 2);
+        let field = krishiv_udf_sdk::ScalarUdf::return_field(&udf_impl, &[]).unwrap();
+        assert_eq!(field.data_type, DataType::Integer);
+        assert!(field.nullable);
+        let props = krishiv_udf_sdk::ScalarUdf::properties(&udf_impl);
+        assert!(props.deterministic);
+        // The column path reports its rows.
+        let array: ArrayRef = Arc::new(arrow_array::Int32Array::from(vec![1, 2]));
+        let out = krishiv_udf_sdk::ScalarUdf::invoke(
+            &udf_impl,
+            &[krishiv_udf_sdk::UdfArg::Column(&array)],
+            2,
+            &krishiv_udf_sdk::InvokeContext {
+                partition: 0,
+                ansi: true,
+                time_zone: None,
+            },
+        )
+        .unwrap();
+        assert_eq!(out.len(), 2);
+    }
+
     fn int(v: i32) -> Expr {
         lit(Literal::Integer(v))
     }
@@ -867,17 +1212,20 @@ mod tests {
                 },
             ))));
         }
-        let conf = Conf::new(false, true, false, SparkProfile::V4_2);
+        let conf = Conf::new(false, true, false, SparkProfile::V4_2, None);
         let mut memo = Memo::default();
         // 2 * 2^200 wraps to 0 in legacy mode: the value is the kernels'.
-        let first = super::constant(&e, conf, &mut memo);
+        let first = super::constant(&e, conf, &mut memo, &BuiltinFunctions::new());
         assert!(first.is_some());
         assert_eq!(memo.map.len(), depth + 1, "one entry per distinct node");
-        assert_eq!(super::constant(&e, conf, &mut memo), first);
+        assert_eq!(
+            super::constant(&e, conf, &mut memo, &BuiltinFunctions::new()),
+            first
+        );
         assert_eq!(memo.map.len(), depth + 1);
         // Another setting folds under its own entries.
-        let ansi = Conf::new(true, true, false, SparkProfile::V4_2);
-        let _ = super::constant(&e, ansi, &mut memo);
+        let ansi = Conf::new(true, true, false, SparkProfile::V4_2, None);
+        let _ = super::constant(&e, ansi, &mut memo, &BuiltinFunctions::new());
         assert_eq!(memo.map.len(), 2 * (depth + 1));
     }
 
@@ -892,8 +1240,9 @@ mod tests {
         ));
         let class = |profile| match super::constant(
             &rem,
-            Conf::new(true, true, false, profile),
+            Conf::new(true, true, false, profile, None),
             &mut Memo::default(),
+            &BuiltinFunctions::new(),
         ) {
             Some(Constant::Error(e)) => e.error_class(),
             other => panic!("{other:?}"),
@@ -1260,10 +1609,10 @@ mod tests {
         std::thread::Builder::new()
             .stack_size(2 << 20)
             .spawn(move || {
-                let conf = Conf::new(false, true, false, SparkProfile::V4_2);
+                let conf = Conf::new(false, true, false, SparkProfile::V4_2, None);
                 let mut memo = Memo::default();
                 assert_eq!(
-                    super::constant(&e, conf, &mut memo),
+                    super::constant(&e, conf, &mut memo, &BuiltinFunctions::new()),
                     Some(Constant::Integral(crate::MAX_DEPTH as i64 - 1))
                 );
             })
diff --git a/crates/krishiv-plan/src/analyzer/setops.rs b/crates/krishiv-plan/src/analyzer/setops.rs
index 82551a2f3..8aaf8598e 100644
--- a/crates/krishiv-plan/src/analyzer/setops.rs
+++ b/crates/krishiv-plan/src/analyzer/setops.rs
@@ -281,21 +281,32 @@ impl Resolver<'_> {
             }
             let reject = match &e.node {
                 ExprNode::Subquery { .. } | ExprNode::Window(_) => true,
-                ExprNode::Function(f) if Builtin::from_name(&f.name).is_none() => {
-                    match self
-                        .ctx
-                        .functions
-                        .lookup(std::slice::from_ref(&f.name), self.ctx.profile)
+                ExprNode::Function(f)
+                    if f.unqualified()
+                        .is_none_or(|n| Builtin::from_name(n).is_none()) =>
+                {
+                    let session_parts;
+                    let lookup_name: &[String] = if super::bind::is_session_qualifier(&f.qualifier)
                     {
+                        session_parts = {
+                            let mut p = f.qualifier.clone();
+                            p.push(f.name.clone());
+                            p
+                        };
+                        &session_parts
+                    } else {
+                        std::slice::from_ref(&f.name)
+                    };
+                    match self.ctx.functions.lookup(lookup_name, self.ctx.profile) {
                         FunctionLookup::Found(entry) => {
                             !entry.deterministic || !matches!(entry.kind, FunctionKind::Scalar)
                         }
                         // A function the engine lacks but Spark analyzes as
                         // nondeterministic (like `rand`) cannot be
                         // evaluated here either.
-                        FunctionLookup::KnownUnsupported => {
-                            self.ctx.functions.spark_deterministic(&f.name) == Some(false)
-                        }
+                        FunctionLookup::KnownUnsupported => f.unqualified().is_some_and(|n| {
+                            self.ctx.functions.spark_deterministic(n) == Some(false)
+                        }),
                         FunctionLookup::NotFound => false,
                     }
                 }
diff --git a/crates/krishiv-plan/src/display.rs b/crates/krishiv-plan/src/display.rs
index b3b03e52c..35aec562e 100644
--- a/crates/krishiv-plan/src/display.rs
+++ b/crates/krishiv-plan/src/display.rs
@@ -650,7 +650,7 @@ fn expr_pieces<'a>(e: &'a Expr, out: &mut Vec<Piece<'a>>) {
         })) => {
             let op = match id {
                 FunctionId::Builtin(b) => Some(*b),
-                FunctionId::Registry { .. } => None,
+                FunctionId::Registry { .. } | FunctionId::Udf { .. } => None,
             };
             call(id.name(), op, args, &[], *distinct, filter.as_deref(), out);
         }
diff --git a/crates/krishiv-plan/src/encode.rs b/crates/krishiv-plan/src/encode.rs
index 3c6bba4e5..c8fd5895d 100644
--- a/crates/krishiv-plan/src/encode.rs
+++ b/crates/krishiv-plan/src/encode.rs
@@ -537,6 +537,18 @@ impl<'k, 'a> Encoder<'k, 'a> {
         self.bytes(s.as_bytes());
     }
 
+    /// A function's identity in a key: its canonical name, never a registry
+    /// id (see `FunctionId`), and for a UDF its version, so a re-registered
+    /// UDF never shares a key with the version it replaced. Kept out of line
+    /// so the recursive expression encoder's frame stays small.
+    #[inline(never)]
+    fn function_id(&mut self, id: &crate::FunctionId) {
+        self.str(id.name());
+        if let crate::FunctionId::Udf { version, .. } = id {
+            self.u32(*version);
+        }
+    }
+
     fn bytes(&mut self, b: &[u8]) {
         self.len(b.len());
         self.put(b);
@@ -1054,9 +1066,7 @@ impl<'k, 'a> Encoder<'k, 'a> {
                 deterministic: _,
             })) => {
                 self.u8(10);
-                // The canonical name only: a registry id is never part of
-                // a key (see `FunctionId`).
-                self.str(id.name());
+                self.function_id(id);
                 self.u8(kind.code());
                 self.data_type(data_type);
                 self.bool(*nullable);
diff --git a/crates/krishiv-plan/src/expr.rs b/crates/krishiv-plan/src/expr.rs
index 816a6e803..3c2f73646 100644
--- a/crates/krishiv-plan/src/expr.rs
+++ b/crates/krishiv-plan/src/expr.rs
@@ -160,7 +160,8 @@ pub struct FunctionCall {
     /// The qualifier parts (`builtin` in `builtin.abs(x)`), outermost
     /// first; empty for an unqualified call. The analyzer resolves
     /// `builtin.` / `system.builtin.` (case-insensitively) to the builtin
-    /// function and reports any other qualifier as an unresolved routine.
+    /// function, `session.` / `system.session.` to a session UDF, and
+    /// reports any other qualifier as an unresolved routine.
     pub qualifier: Vec<String>,
     /// The arguments.
     pub args: Vec<Arc<Expr>>,
@@ -175,6 +176,15 @@ pub struct FunctionCall {
     pub filter: Option<Arc<Expr>>,
 }
 
+impl FunctionCall {
+    /// The name when it is unqualified (no qualifier), as operators and
+    /// the name-based function checks require.
+    #[must_use]
+    pub fn unqualified(&self) -> Option<&str> {
+        self.qualifier.is_empty().then_some(&self.name)
+    }
+}
+
 /// How a cast handles invalid input.
 ///
 /// [`CastMode::Default`] appears only in unresolved plans: the analyzer
@@ -723,7 +733,7 @@ impl Expr {
 /// resolved): a frame bound written `x PRECEDING`.
 pub(crate) fn negated(e: &Expr) -> Option<&Arc<Expr>> {
     let (name, args) = match &e.node {
-        ExprNode::Function(f) => (f.name.as_str(), &f.args),
+        ExprNode::Function(f) => (f.unqualified()?, &f.args),
         ExprNode::Resolved(ResolvedExpr::Function(f)) => (f.id.name(), &f.args),
         _ => return None,
     };
@@ -765,3 +775,50 @@ impl Drop for Expr {
         walk::teardown_expr(self);
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::literal::Literal;
+
+    #[test]
+    fn negated_finds_negative_operands_resolved_or_not() {
+        let inner = Arc::new(Expr::literal(Literal::Integer(3)));
+        // Unresolved `negative(x)`.
+        let unresolved = Expr::new(ExprNode::Function(FunctionCall {
+            name: "negative".to_owned(),
+            qualifier: Vec::new(),
+            args: vec![Arc::clone(&inner)],
+            arg_names: Vec::new(),
+            distinct: false,
+            filter: None,
+        }));
+        assert!(negated(&unresolved).is_some());
+        // A qualified name is never an operator.
+        let qualified = Expr::new(ExprNode::Function(FunctionCall {
+            name: "negative".to_owned(),
+            qualifier: vec!["session".to_owned()],
+            args: vec![Arc::clone(&inner)],
+            arg_names: Vec::new(),
+            distinct: false,
+            filter: None,
+        }));
+        assert!(negated(&qualified).is_none());
+        // Resolved `-x` (a UDF id works like any other: only the name matters).
+        let resolved = Expr::new(ExprNode::Resolved(ResolvedExpr::Function(
+            ResolvedFunction {
+                id: FunctionId::Builtin(Builtin::Negative),
+                kind: FunctionKind::Scalar,
+                args: vec![Arc::clone(&inner)],
+                distinct: false,
+                filter: None,
+                data_type: DataType::Integer,
+                nullable: false,
+                deterministic: true,
+            },
+        )));
+        assert!(negated(&resolved).is_some());
+        // Anything else is not negated.
+        assert!(negated(&Expr::literal(Literal::Integer(1))).is_none());
+    }
+}
diff --git a/crates/krishiv-plan/src/function.rs b/crates/krishiv-plan/src/function.rs
index 786574e52..64306e47c 100644
--- a/crates/krishiv-plan/src/function.rs
+++ b/crates/krishiv-plan/src/function.rs
@@ -227,11 +227,12 @@ impl Builtin {
 
 /// The identity of a resolved function.
 ///
-/// A function is identified by its canonical name: [`Builtin::name`] or the
-/// registry's lower-case name. Only the name (with the kind) enters the
-/// canonical encoding and the structural hash; a registry id is an
-/// in-process lookup handle and never part of a key, so keys stay valid
-/// across builds whose registries number functions differently.
+/// A function is identified by its canonical name: [`Builtin::name`], the
+/// registry's lower-case name, or a UDF's lower-case name and version. Only
+/// the name (with the kind), and for a UDF its version, enter the canonical
+/// encoding and the structural hash; a registry id is an in-process lookup
+/// handle and never part of a key, so keys stay valid across builds whose
+/// registries number functions differently.
 #[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
 #[non_exhaustive]
 pub enum FunctionId {
@@ -244,6 +245,15 @@ pub enum FunctionId {
         /// The registry's handle for this process; not part of any key.
         id: u32,
     },
+    /// A session-registered native Rust UDF: its lower-case name and the
+    /// implementation [`version`](krishiv_udf_sdk::ScalarUdf::version) the
+    /// call was analyzed with.
+    Udf {
+        /// The canonical (lower-case) name: the identity, with `version`.
+        name: String,
+        /// The implementation version: part of the identity.
+        version: u32,
+    },
 }
 
 impl FunctionId {
@@ -252,7 +262,7 @@ impl FunctionId {
     pub fn name(&self) -> &str {
         match self {
             Self::Builtin(b) => b.name(),
-            Self::Registry { name, .. } => name,
+            Self::Registry { name, .. } | Self::Udf { name, .. } => name,
         }
     }
 }
diff --git a/crates/krishiv-plan/src/raises.rs b/crates/krishiv-plan/src/raises.rs
index 51f1d83e6..473a892ad 100644
--- a/crates/krishiv-plan/src/raises.rs
+++ b/crates/krishiv-plan/src/raises.rs
@@ -134,6 +134,8 @@ fn function_never_raises(id: &FunctionId, args: &[std::sync::Arc<Expr>], ansi: b
             "try_add" | "try_subtract" | "try_multiply" | "try_divide" | "try_mod" => numeric(),
             _ => false,
         },
+        // User code may raise (or fail its contract): never assumed pure.
+        FunctionId::Udf { .. } => false,
     }
 }
 
@@ -460,9 +462,20 @@ mod tests {
             false
         ));
         assert!(!may_raise(
-            &named("startswith", vec![s.clone(), s], DataType::Boolean),
+            &named("startswith", vec![s.clone(), s.clone()], DataType::Boolean),
             false
         ));
+        // User code may raise (or fail its contract): never assumed pure.
+        let udf = call(
+            FunctionId::Udf {
+                name: "my_udf".to_owned(),
+                version: 1,
+            },
+            vec![s],
+            DataType::Boolean,
+        );
+        assert!(may_raise(&udf, false));
+        assert!(may_raise(&udf, true));
     }
 
     #[test]
diff --git a/crates/krishiv-plan/src/tests/encode.rs b/crates/krishiv-plan/src/tests/encode.rs
index a8f9cde86..484350edf 100644
--- a/crates/krishiv-plan/src/tests/encode.rs
+++ b/crates/krishiv-plan/src/tests/encode.rs
@@ -297,6 +297,31 @@ fn lambda_and_its_variables_enter_the_key() {
     assert_ne!(p(col), base, "variable tag");
 }
 
+/// A session UDF's version is part of its key: re-registering a UDF never
+/// reuses a key of the version it replaced.
+#[test]
+fn udf_versions_enter_the_key() {
+    let call = |version: u32| {
+        let func = ResolvedFunction {
+            id: FunctionId::Udf {
+                name: "f".to_owned(),
+                version,
+            },
+            kind: FunctionKind::Scalar,
+            args: vec![Arc::new(Expr::column(["a"]))],
+            distinct: false,
+            filter: None,
+            data_type: DataType::String,
+            nullable: true,
+            deterministic: true,
+        };
+        let call = Expr::new(ExprNode::Resolved(ResolvedExpr::Function(func)));
+        LogicalPlan::table(["t"]).project(vec![call])
+    };
+    assert_eq!(key(call(1)), key(call(1)));
+    assert_ne!(key(call(1)), key(call(2)), "version");
+}
+
 /// A function's key is its name, kind and arguments, never its registry
 /// handle, so a cache shared across builds cannot confuse two functions.
 #[test]
diff --git a/crates/krishiv-plan/src/tests/props.rs b/crates/krishiv-plan/src/tests/props.rs
index 812dce8b9..89ae33619 100644
--- a/crates/krishiv-plan/src/tests/props.rs
+++ b/crates/krishiv-plan/src/tests/props.rs
@@ -824,6 +824,11 @@ fn m_expr(e: &mut Arc<Expr>, w: &mut Walk) -> bool {
                         name: format!("{name}x"),
                         id: *id,
                     },
+                    // A UDF at another version resolves differently.
+                    FunctionId::Udf { name, version } => FunctionId::Udf {
+                        name: name.clone(),
+                        version: version.wrapping_add(1),
+                    },
                 };
                 site!(w, *id = other);
                 site!(w, flip(kind, FunctionKind::Scalar, FunctionKind::Window));
diff --git a/crates/krishiv-session/Cargo.toml b/crates/krishiv-session/Cargo.toml
index dece1ec74..c774a7a73 100644
--- a/crates/krishiv-session/Cargo.toml
+++ b/crates/krishiv-session/Cargo.toml
@@ -15,12 +15,14 @@ arrow-schema.workspace = true
 futures = { workspace = true, features = ["alloc", "executor"] }
 krishiv-common = { path = "../krishiv-common" }
 krishiv-exec = { path = "../krishiv-exec" }
+krishiv-functions = { path = "../krishiv-functions" }
 krishiv-io = { path = "../krishiv-io" }
 krishiv-memory = { path = "../krishiv-memory" }
 krishiv-optimizer = { path = "../krishiv-optimizer" }
 krishiv-plan = { path = "../krishiv-plan" }
 krishiv-sql = { path = "../krishiv-sql" }
 krishiv-types = { path = "../krishiv-types" }
+krishiv-udf-sdk = { path = "../krishiv-udf-sdk" }
 # The `EXPLAIN VERBOSE` JSON document.
 serde_json = { workspace = true, features = ["std"] }
 # Warnings from analysis and planning are logged, as Spark logs them.
diff --git a/crates/krishiv-session/public-api.txt b/crates/krishiv-session/public-api.txt
index 877c57ce5..287a5e360 100644
--- a/crates/krishiv-session/public-api.txt
+++ b/crates/krishiv-session/public-api.txt
@@ -2,16 +2,27 @@ pub mod krishiv_session
 pub use krishiv_session::AccessDecision
 pub use krishiv_session::AccessPolicy
 pub use krishiv_session::AllowAll
+pub use krishiv_session::ArgField
 pub use krishiv_session::DenyAll
 pub use krishiv_session::ExplainKind
+pub use krishiv_session::InvokeContext
+pub use krishiv_session::NullHandling
 pub use krishiv_session::Principal
 pub use krishiv_session::PrincipalKind
 pub use krishiv_session::Privilege
 pub use krishiv_session::QueryProfile
+pub use krishiv_session::ReturnField
+pub use krishiv_session::ScalarUdf
 pub use krishiv_session::Securable
 pub use krishiv_session::SecurableUse
+pub use krishiv_session::Signature
 pub use krishiv_session::StatementClass
 pub use krishiv_session::TextOptions
+pub use krishiv_session::UdfArg
+pub use krishiv_session::UdfError
+pub use krishiv_session::UdfInputType
+pub use krishiv_session::UdfLibrary
+pub use krishiv_session::UdfProperties
 pub mod krishiv_session::functions
 pub trait krishiv_session::functions::IntoLiteral
 pub fn krishiv_session::functions::IntoLiteral::into_literal(self) -> krishiv_plan::literal::Literal
@@ -312,6 +323,7 @@ pub fn krishiv_session::Session::memory_reserved(&self) -> usize
 pub fn krishiv_session::Session::new() -> core::result::Result<Self, krishiv_common::error::KrishivError>
 pub fn krishiv_session::Session::read(&self) -> krishiv_session::DataFrameReader
 pub fn krishiv_session::Session::register_batches(&self, &str, arrow_schema::schema::SchemaRef, alloc::vec::Vec<arrow_array::record_batch::RecordBatch>) -> core::result::Result<(), krishiv_common::error::KrishivError>
+pub fn krishiv_session::Session::register_udf(&self, impl krishiv_udf_sdk::udf::ScalarUdf) -> core::result::Result<(), krishiv_common::error::KrishivError>
 pub async fn krishiv_session::Session::sql(&self, &str) -> core::result::Result<krishiv_session::DataFrame, krishiv_common::error::KrishivError>
 pub fn krishiv_session::Session::table(&self, &str) -> krishiv_session::DataFrame
 pub fn krishiv_session::Session::temp_table_names(&self) -> alloc::vec::Vec<alloc::string::String>
@@ -332,6 +344,20 @@ pub fn krishiv_session::SessionBuilder::principal(self, krishiv_plan::analyzer::
 pub fn krishiv_session::SessionBuilder::profile(self, krishiv_functions::signature::SparkProfile) -> Self
 impl core::fmt::Debug for krishiv_session::SessionBuilder
 pub fn krishiv_session::SessionBuilder::fmt(&self, &mut core::fmt::Formatter<'_>) -> core::fmt::Result
+pub struct krishiv_session::SessionFunctions
+impl krishiv_session::SessionFunctions
+pub fn krishiv_session::SessionFunctions::library(&self) -> &alloc::sync::Arc<krishiv_udf_sdk::library::UdfLibrary>
+pub fn krishiv_session::SessionFunctions::new(alloc::sync::Arc<krishiv_udf_sdk::library::UdfLibrary>) -> Self
+pub fn krishiv_session::SessionFunctions::with_registry(alloc::sync::Arc<dyn krishiv_plan::analyzer::catalog::FunctionRegistry>, alloc::sync::Arc<krishiv_udf_sdk::library::UdfLibrary>) -> Self
+impl core::clone::Clone for krishiv_session::SessionFunctions
+pub fn krishiv_session::SessionFunctions::clone(&self) -> krishiv_session::SessionFunctions
+impl core::fmt::Debug for krishiv_session::SessionFunctions
+pub fn krishiv_session::SessionFunctions::fmt(&self, &mut core::fmt::Formatter<'_>) -> core::fmt::Result
+impl krishiv_plan::analyzer::catalog::FunctionRegistry for krishiv_session::SessionFunctions
+pub fn krishiv_session::SessionFunctions::lookup(&self, &[alloc::string::String], krishiv_functions::signature::SparkProfile) -> krishiv_plan::analyzer::catalog::FunctionLookup
+pub fn krishiv_session::SessionFunctions::resolve_udf(&self, &str, u32) -> core::option::Option<alloc::sync::Arc<dyn krishiv_udf_sdk::udf::ScalarUdf>>
+pub fn krishiv_session::SessionFunctions::spark_deterministic(&self, &str) -> core::option::Option<bool>
+pub fn krishiv_session::SessionFunctions::version(&self) -> u64
 #[non_exhaustive] pub struct krishiv_session::StatementInfo
 pub krishiv_session::StatementInfo::class: krishiv_sql::classify::StatementClass
 pub krishiv_session::StatementInfo::explain: core::option::Option<krishiv_sql::classify::ExplainKind>
diff --git a/crates/krishiv-session/src/column.rs b/crates/krishiv-session/src/column.rs
index 462c6e713..e83277e74 100644
--- a/crates/krishiv-session/src/column.rs
+++ b/crates/krishiv-session/src/column.rs
@@ -316,11 +316,14 @@ impl Column {
         }
     }
 
-    /// The expression of an aggregate call `name(args)`.
+    /// The expression of an aggregate call `name(args)`. Dots separate
+    /// name parts outside backquotes, as in SQL (`system.session.f`).
     pub(crate) fn function(name: &str, args: Vec<Self>, distinct: bool) -> Self {
+        let mut parts = split_name(name);
+        let func = parts.pop().unwrap_or_default();
         Self::new(Expr::new(ExprNode::Function(FunctionCall {
-            name: name.to_owned(),
-            qualifier: Vec::new(),
+            name: func,
+            qualifier: parts,
             arg_names: Vec::new(),
             args: args.into_iter().map(|c| Arc::new(c.expr)).collect(),
             distinct,
diff --git a/crates/krishiv-session/src/lib.rs b/crates/krishiv-session/src/lib.rs
index 4eed1a361..39b034d25 100644
--- a/crates/krishiv-session/src/lib.rs
+++ b/crates/krishiv-session/src/lib.rs
@@ -52,6 +52,7 @@ mod explain_graph;
 pub mod functions;
 mod profile;
 mod session;
+mod udfs;
 mod variables;
 
 pub use access::{PathPrefixPolicy, StatementInfo};
@@ -69,5 +70,12 @@ pub use krishiv_plan::analyzer::{
     Securable, SecurableUse,
 };
 pub use krishiv_sql::{ExplainKind, StatementClass};
+pub use krishiv_udf_sdk::{
+    ArgField, InvokeContext, NullHandling, ReturnField, ScalarUdf, Signature, UdfArg, UdfError,
+    UdfInputType, UdfLibrary, UdfProperties,
+};
 pub use profile::{ExplainVerbose, OptimizerStep, VERBOSE_FORMAT, VERBOSE_VERSION};
 pub use session::{RecordBatchStream, Session, SessionBuilder};
+/// Native Rust scalar UDFs: the [`ScalarUdf`] trait and its boundary types,
+/// for [`Session::register_udf`].
+pub use udfs::SessionFunctions;
diff --git a/crates/krishiv-session/src/session.rs b/crates/krishiv-session/src/session.rs
index e52d7d67c..833390b89 100644
--- a/crates/krishiv-session/src/session.rs
+++ b/crates/krishiv-session/src/session.rs
@@ -36,14 +36,15 @@ use krishiv_memory::{
 use krishiv_plan::analyzer::QueryContext as PlanQueryContext;
 use krishiv_plan::analyzer::{
     AccessPolicy, AllowAll, AnalysisContext, AnalysisError, AnalyzedPlan, Analyzer as _,
-    BuiltinFunctions, DefaultAnalyzer, FunctionRegistry, Principal, Privilege, ResolutionConf,
-    Securable, SparkProfile, TableColumn, authorize,
+    DefaultAnalyzer, FunctionRegistry, Principal, Privilege, ResolutionConf, Securable,
+    SparkProfile, TableColumn, authorize,
 };
 use krishiv_plan::{LogicalPlan, Plan, PlanId, PlanNode, ReadSource, SourceId};
 use krishiv_sql::ast::Statement;
 use krishiv_sql::{Frontend, ParserOptions, StatementClass};
 use krishiv_types::DataType;
 use krishiv_types::batch::{Batch, Weights};
+use krishiv_udf_sdk::{UdfLibrary, guard_call};
 use object_store::ObjectStore;
 use object_store::local::LocalFileSystem;
 
@@ -52,6 +53,7 @@ use crate::catalog::{is_hidden_name, reserved_temp_view_name};
 use crate::column::Column;
 use crate::conf::{self, ConfStore, RuntimeConf};
 use crate::dataframe::{DataFrame, DataFrameReader};
+use crate::udfs::SessionFunctions;
 use crate::variables::SessionVariables;
 
 /// The store id of the local file system.
@@ -105,6 +107,9 @@ pub(crate) struct SessionState {
     pub(crate) principal: Arc<Principal>,
     pub(crate) policy: Arc<dyn AccessPolicy>,
     functions: Arc<dyn FunctionRegistry>,
+    /// The session's registered UDFs, shared with the registry above and
+    /// the workers running its plans.
+    udfs: Arc<UdfLibrary>,
     executor: Arc<dyn Executor>,
     runner: QueryRunner,
     memory: Arc<dyn MemoryPool>,
@@ -271,6 +276,12 @@ impl SessionBuilder {
             .ok()
             .and_then(|d| d.to_str().map(str::to_owned))
             .unwrap_or_else(|| "/".to_owned());
+        let udfs = Arc::new(UdfLibrary::new());
+        let functions = match self.functions {
+            Some(f) => Arc::new(SessionFunctions::with_registry(f, Arc::clone(&udfs)))
+                as Arc<dyn FunctionRegistry>,
+            None => Arc::new(SessionFunctions::new(Arc::clone(&udfs))) as Arc<dyn FunctionRegistry>,
+        };
         Ok(Session {
             state: Arc::new(SessionState {
                 conf: Arc::new(ConfStore::new(config)),
@@ -279,9 +290,8 @@ impl SessionBuilder {
                 profile: self.profile,
                 principal: Arc::new(self.principal.unwrap_or_else(Principal::local_user)),
                 policy: self.policy.unwrap_or_else(|| Arc::new(AllowAll)),
-                functions: self
-                    .functions
-                    .unwrap_or_else(|| Arc::new(BuiltinFunctions::new())),
+                functions,
+                udfs,
                 runner: QueryRunner::new(Arc::clone(&executor)),
                 executor,
                 memory,
@@ -553,6 +563,70 @@ impl Session {
         Ok(())
     }
 
+    /// Registers a native Rust scalar UDF under its name
+    /// (case-insensitive), replacing any UDF of that name. Built-ins keep precedence on the
+    /// bare search path; qualify with `system.session` (or `session`) to
+    /// reach the UDF when a built-in shares its name. Every registration
+    /// changes the analysis fingerprint, so plans analyzed before it are
+    /// never reused after it.
+    ///
+    /// ```
+    /// # use krishiv_session::{ScalarUdf, Session};
+    /// # use krishiv_session::{ArgField, InvokeContext, ReturnField, Signature, UdfArg, UdfError, UdfInputType};
+    /// # use krishiv_types::DataType;
+    /// # use std::sync::Arc;
+    /// # use arrow_array::ArrayRef;
+    /// # #[derive(Debug)] struct One;
+    /// # impl ScalarUdf for One {
+    /// #     fn name(&self) -> &str { "one" }
+    /// #     fn version(&self) -> u32 { 1 }
+    /// #     fn signature(&self) -> &Signature {
+    /// #         use std::sync::OnceLock; static SIG: OnceLock<Signature> = OnceLock::new();
+    /// #         SIG.get_or_init(|| Signature::Exact(Vec::new()))
+    /// #     }
+    /// #     fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+    /// #         Ok(ReturnField { data_type: DataType::Integer, nullable: false })
+    /// #     }
+    /// #     fn invoke(&self, _: &[UdfArg<'_>], _: usize, _: &InvokeContext) -> Result<ArrayRef, UdfError> {
+    /// #         Ok(Arc::new(arrow_array::Int32Array::from(vec![1])) as ArrayRef)
+    /// #     }
+    /// # }
+    /// let session = Session::new()?;
+    /// session.register_udf(One)?;
+    /// let df = futures::executor::block_on(session.sql("SELECT one()"))?;
+    /// let rows = futures::executor::block_on(df.collect())?;
+    /// assert_eq!(rows.iter().map(|b| b.num_rows()).sum::<usize>(), 1);
+    /// # Ok::<(), krishiv_common::error::KrishivError>(())
+    /// ```
+    ///
+    /// # Errors
+    /// `FAILED_EXECUTE_UDF` when the UDF's `name` panics, is empty, or
+    /// contains a `.` or a backtick, since such a UDF can never be called
+    /// by name (the function name is `unknown` when there is none).
+    pub fn register_udf(
+        &self,
+        udf: impl krishiv_udf_sdk::ScalarUdf,
+    ) -> Result<(), krishiv_common::error::KrishivError> {
+        let udf: Arc<dyn krishiv_udf_sdk::ScalarUdf> = Arc::new(udf);
+        if let Err(e) = self.state.udfs.register(Arc::clone(&udf)) {
+            let name = guard_call("unknown", "name", || udf.name().to_owned())
+                .map(|name| name.to_lowercase())
+                .unwrap_or_else(|_| "unknown".to_owned());
+            let name = if name.is_empty() {
+                "unknown".to_owned()
+            } else {
+                name
+            };
+            return Err(krishiv_functions::scalar::failed_execute(
+                &name,
+                "unknown",
+                "unknown",
+                e.message(),
+            ));
+        }
+        Ok(())
+    }
+
     /// The temporary tables and views, by name as registered.
     ///
     /// ```
@@ -733,15 +807,26 @@ impl Session {
             Arc::clone(&env.catalog) as Arc<dyn krishiv_exec::planner::TableProviderResolver>;
         let stats = ProviderStatistics(Arc::clone(&tables));
         let (optimized, steps) = if trace {
-            krishiv_optimizer::optimize_traced(&analyzed.plan, &stats)?
+            krishiv_optimizer::optimize_traced_with_udfs(
+                &analyzed.plan,
+                &stats,
+                &self.state.udfs,
+                &env.config,
+            )?
         } else {
             (
-                krishiv_optimizer::optimize_with(&analyzed.plan, &stats)?,
+                krishiv_optimizer::optimize_with_udfs(
+                    &analyzed.plan,
+                    &stats,
+                    &self.state.udfs,
+                    &env.config,
+                )?,
                 Vec::new(),
             )
         };
         let cx = PlanningContext::new(tables, Arc::clone(&env.config))
-            .with_user(self.state.principal.name.as_str());
+            .with_user(self.state.principal.name.as_str())
+            .with_udfs(Arc::clone(&self.state.udfs));
         let physical = self.state.planner.plan(&optimized, &cx)?;
         // Spark logs what analysis and planning ignore (hints) as
         // warnings; `DataFrame::warnings` returns them too.
@@ -1061,14 +1146,15 @@ impl Session {
     }
 
     /// What a query's plans are instantiated with in this process: the
-    /// query's tables, and its spill scope under the session's spill
-    /// directory (created at instantiation). Writes build their sink from
-    /// the plan with the query's I/O context, formats and configuration;
+    /// query's tables, its UDFs, and its spill scope under the session's
+    /// spill directory (created at instantiation). Writes build their sink
+    /// from the plan with the query's I/O context, formats and configuration;
     /// batch splits resolve through the session's relation store.
     fn worker(&self, env: &QueryEnv) -> WorkerContext {
         WorkerContext::new(
             Arc::clone(&env.catalog) as Arc<dyn krishiv_exec::planner::TableProviderResolver>
         )
+        .with_udfs(Arc::clone(&self.state.udfs))
         .with_relations(Arc::clone(&self.state.relations))
         .with_spill_scopes(Arc::new(QuerySpill {
             state: Arc::clone(&self.state),
diff --git a/crates/krishiv-session/src/udfs.rs b/crates/krishiv-session/src/udfs.rs
new file mode 100644
index 000000000..2b1120556
--- /dev/null
+++ b/crates/krishiv-session/src/udfs.rs
@@ -0,0 +1,828 @@
+// SPDX-License-Identifier: Apache-2.0
+//! Session functions: Spark's built-ins plus the session's registered
+//! native Rust UDFs.
+//!
+//! A [`SessionFunctions`] wraps the built-in [`BuiltinFunctions`] (or a
+//! custom registry) and the session's [`UdfLibrary`]. Bare names resolve
+//! built-ins first (Spark's search path: `system.builtin` before
+//! `system.session`), so registering a name like `upper` does not shadow
+//! the built-in; `system.builtin.f` reaches built-ins only, while
+//! `system.session.f` and `session.f` reach UDFs only. Unknown names keep
+//! today's `UNRESOLVED_ROUTINE`.
+
+use std::sync::Arc;
+
+use krishiv_common::error::{FailedExecuteUdf, KrishivError};
+use krishiv_plan::analyzer::{
+    ArgType, Arity, BuiltinFunctions, CallTypes, FunctionEntry, FunctionLookup, FunctionRegistry,
+    InputType, Inputs, SparkProfile,
+};
+use krishiv_plan::{FunctionId, FunctionKind};
+use krishiv_udf_sdk::{
+    ArgField, NullHandling, ScalarUdf, Signature, UdfInputType, UdfLibrary, guard_call,
+};
+
+/// The function registry of a session: built-ins plus its UDFs.
+#[derive(Clone)]
+pub struct SessionFunctions {
+    inner: Arc<dyn FunctionRegistry>,
+    udfs: Arc<UdfLibrary>,
+}
+
+impl std::fmt::Debug for SessionFunctions {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("SessionFunctions")
+            .field("udfs", &self.udfs)
+            .finish_non_exhaustive()
+    }
+}
+
+impl SessionFunctions {
+    /// Built-ins plus `udfs`.
+    #[must_use]
+    pub fn new(udfs: Arc<UdfLibrary>) -> Self {
+        Self {
+            inner: Arc::new(BuiltinFunctions::new()),
+            udfs,
+        }
+    }
+
+    /// `inner` plus `udfs` (for sessions with a custom registry). Names
+    /// arrive lower-cased, as Spark resolves function names
+    /// case-insensitively.
+    #[must_use]
+    pub fn with_registry(inner: Arc<dyn FunctionRegistry>, udfs: Arc<UdfLibrary>) -> Self {
+        Self { inner, udfs }
+    }
+
+    /// The session's UDF library.
+    #[must_use]
+    pub fn library(&self) -> &Arc<UdfLibrary> {
+        &self.udfs
+    }
+
+    /// The [`FunctionEntry`] of the UDF named `name` (already lower-case),
+    /// or [`FunctionLookup::NotFound`]. A signature form the engine does
+    /// not implement is [`FunctionLookup::KnownUnsupported`], as for a
+    /// built-in it lacks. Every UDF trait call goes through
+    /// [`guard_call`], so a panicking `signature`, `properties`,
+    /// `return_field` or `version` becomes `FAILED_EXECUTE_UDF` rather
+    /// than unwinding the analyzer.
+    fn udf_entry(&self, name: &str) -> FunctionLookup {
+        let Some(udf) = self.udfs.get(name) else {
+            return FunctionLookup::NotFound;
+        };
+        // `version` is part of the plan identity: a panic fails the call
+        // rather than the analyzer.
+        let version = match guard_call(name, "version", || udf.version()) {
+            Ok(v) => v,
+            Err(e) => return FunctionLookup::Found(failing_entry(name, 0, "unknown", e.message())),
+        };
+        let signature = match guard_call(name, "signature", || udf.signature().clone()) {
+            Ok(s) => s,
+            Err(e) => {
+                return FunctionLookup::Found(failing_entry(name, version, "unknown", e.message()));
+            }
+        };
+        let Some((arity, inputs)) = signature_parts(&signature) else {
+            return FunctionLookup::KnownUnsupported;
+        };
+        let properties = match guard_call(name, "properties", || udf.properties()) {
+            Ok(p) => p,
+            Err(e) => {
+                return FunctionLookup::Found(failing_entry(
+                    name,
+                    version,
+                    &signature.inputs_sql(),
+                    e.message(),
+                ));
+            }
+        };
+        let strict = matches!(properties.null_handling, NullHandling::Strict);
+        let deterministic = properties.deterministic;
+        let entry_udf = Arc::clone(&udf);
+        let entry_name = name.to_owned();
+        let signature_sql = signature.inputs_sql();
+        let result = Arc::new(move |call: &CallTypes<'_>| {
+            let fields: Vec<ArgField> = call
+                .args()
+                .iter()
+                .map(|a| ArgField {
+                    data_type: a.data_type.clone(),
+                    nullable: a.nullable,
+                })
+                .collect();
+            // A strict UDF never sees a null row (null inputs give null
+            // without invoking), so its result is nullable whenever any
+            // argument may be null, even when it declares non-nullable
+            // results.
+            let any_nullable = fields.iter().any(|f| f.nullable);
+            let widen = strict && any_nullable;
+            let entry_name = entry_name.clone();
+            let signature_sql = signature_sql.clone();
+            match guard_call(&entry_name, "return_field", || {
+                entry_udf.return_field(&fields)
+            }) {
+                Ok(Ok(r)) => Ok(ArgType {
+                    data_type: Some(r.data_type),
+                    nullable: r.nullable || widen,
+                }),
+                Ok(Err(e)) | Err(e) => Err(KrishivError::from(FailedExecuteUdf {
+                    function_name: entry_name,
+                    signature: signature_sql,
+                    result: "unknown".to_owned(),
+                    reason: e.message().to_owned(),
+                })),
+            }
+        });
+        FunctionLookup::Found(FunctionEntry {
+            id: FunctionId::Udf {
+                name: name.to_owned(),
+                version,
+            },
+            kind: FunctionKind::Scalar,
+            arity,
+            inputs,
+            result,
+            deterministic,
+        })
+    }
+}
+
+/// A UDF entry that always fails with `FAILED_EXECUTE_UDF`: what a UDF
+/// whose `signature`, `properties` or `version` panics resolves to, so
+/// the panic surfaces as an error at analysis rather than unwinding it.
+fn failing_entry(name: &str, version: u32, signature: &str, reason: &str) -> FunctionEntry {
+    let entry_name = name.to_owned();
+    let signature_sql = signature.to_owned();
+    let reason = reason.to_owned();
+    let result = Arc::new(move |_: &CallTypes<'_>| {
+        Err(KrishivError::from(FailedExecuteUdf {
+            function_name: entry_name.clone(),
+            signature: signature_sql.clone(),
+            result: "unknown".to_owned(),
+            reason: reason.clone(),
+        }))
+    });
+    FunctionEntry {
+        id: FunctionId::Udf {
+            name: name.to_owned(),
+            version,
+        },
+        kind: FunctionKind::Scalar,
+        arity: Arity::any(),
+        inputs: Inputs::Any,
+        result,
+        // Never folded, moved or duplicated: the error surfaces at execution.
+        deterministic: false,
+    }
+}
+
+/// Whether `a` and `b` name the same qualifier, ASCII case-insensitively
+/// (function names are).
+fn same(a: &str, b: &str) -> bool {
+    a.eq_ignore_ascii_case(b)
+}
+
+impl FunctionRegistry for SessionFunctions {
+    fn lookup(&self, name: &[String], profile: SparkProfile) -> FunctionLookup {
+        let lower: Vec<String> = name.iter().map(|p| p.to_lowercase()).collect();
+        match lower.as_slice() {
+            [f] => match self.inner.lookup(std::slice::from_ref(f), profile) {
+                // Built-ins win over a same-name session UDF.
+                FunctionLookup::Found(entry) => FunctionLookup::Found(entry),
+                FunctionLookup::KnownUnsupported => FunctionLookup::KnownUnsupported,
+                // Not found (or a future registry answer): a UDF may be.
+                FunctionLookup::NotFound | _ => self.udf_entry(f),
+            },
+            // `session.f`: UDFs only.
+            [q, f] if same(q, "session") => self.udf_entry(f),
+            // `system.builtin.f`: built-ins only.
+            [s, q, f] if same(s, "system") && same(q, "builtin") => {
+                match self.inner.lookup(std::slice::from_ref(f), profile) {
+                    FunctionLookup::Found(entry) => FunctionLookup::Found(entry),
+                    other => other,
+                }
+            }
+            // `system.session.f`: UDFs only.
+            [s, q, f] if same(s, "system") && same(q, "session") => self.udf_entry(f),
+            _ => FunctionLookup::NotFound,
+        }
+    }
+
+    fn spark_deterministic(&self, name: &str) -> Option<bool> {
+        if let Some(known) = self.inner.spark_deterministic(name) {
+            return Some(known);
+        }
+        let udf = self.udfs.get(name)?;
+        guard_call(name, "properties", || udf.properties())
+            .ok()
+            .map(|p| p.deterministic)
+    }
+
+    fn resolve_udf(&self, name: &str, version: u32) -> Option<Arc<dyn ScalarUdf>> {
+        self.udfs.get_versioned(name, version)
+    }
+
+    fn version(&self) -> u64 {
+        self.inner
+            .version()
+            .wrapping_add(self.udfs.version().wrapping_mul(0x9E37_79B9_7F4A_7C15))
+    }
+}
+
+/// The [`Arity`] and [`Inputs`] of `signature`: the analyzer's implicit
+/// casts come from these, so a UDF casts like a built-in with the same
+/// declared inputs. [`Signature::Coercible`] positions match strictly
+/// (like [`InputType::Strict`]); the other forms map as written. `None`
+/// for a signature form the engine does not implement yet.
+fn signature_parts(signature: &Signature) -> Option<(Arity, Inputs)> {
+    match signature {
+        Signature::Exact(types) => {
+            let mapped = types.iter().map(to_input).collect::<Option<Vec<_>>>()?;
+            Some((
+                exact_arity(types.len(), types.len().to_string()),
+                Inputs::Expects(mapped),
+            ))
+        }
+        Signature::Coercible(types) => {
+            let mapped = types
+                .iter()
+                .map(|t| to_input(t).map(to_strict))
+                .collect::<Option<Vec<_>>>()?;
+            Some((
+                exact_arity(types.len(), types.len().to_string()),
+                Inputs::Expects(mapped),
+            ))
+        }
+        Signature::Variadic { element, min_arity } => {
+            let mut counts = [false; Arity::PROBED + 1];
+            for (n, slot) in counts.iter_mut().enumerate() {
+                *slot = n >= *min_arity;
+            }
+            Some((
+                Arity::new(counts, signature.arity_text()),
+                Inputs::Expects(vec![to_input(element)?]),
+            ))
+        }
+        // A future signature form: not implemented here.
+        _ => None,
+    }
+}
+
+/// [`Arity`] accepting exactly `n` arguments (`WRONG_NUM_ARGS`
+/// otherwise). Argument counts above [`Arity::PROBED`] are not
+/// representable; such a signature never matches (see
+/// [`Signature::accepts`]).
+fn exact_arity(n: usize, expected: String) -> Arity {
+    let mut counts = [false; Arity::PROBED + 1];
+    if n <= Arity::PROBED {
+        counts[n] = true;
+    }
+    Arity::new(counts, expected)
+}
+
+/// [`Signature::Exact`] positions of a [`Signature::Coercible`] match
+/// strictly.
+fn to_strict(input: InputType) -> InputType {
+    match input {
+        InputType::Exact(t) => InputType::Strict(t),
+        other => other,
+    }
+}
+
+/// A UDF input type as the analyzer's coercion sees it. `None` for a
+/// form the engine does not implement yet.
+fn to_input(t: &UdfInputType) -> Option<InputType> {
+    Some(match t {
+        UdfInputType::Any => InputType::Any,
+        UdfInputType::Exact(t) => InputType::Exact(t.clone()),
+        UdfInputType::Strict(t) => InputType::Strict(t.clone()),
+        UdfInputType::Numeric { intervals } => InputType::Numeric {
+            intervals: *intervals,
+        },
+        UdfInputType::OneOf(types) => InputType::OneOf(types.clone()),
+        // A future input-type form: not implemented here.
+        _ => return None,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use krishiv_plan::analyzer::BuiltinFunctions;
+    use krishiv_types::DataType;
+
+    use super::*;
+
+    #[derive(Debug)]
+    struct Doubles {
+        version: u32,
+    }
+
+    impl ScalarUdf for Doubles {
+        fn name(&self) -> &str {
+            "doubles"
+        }
+
+        fn version(&self) -> u32 {
+            self.version
+        }
+
+        fn signature(&self) -> &Signature {
+            use std::sync::OnceLock;
+            static SIG: OnceLock<Signature> = OnceLock::new();
+            SIG.get_or_init(|| Signature::Coercible(vec![UdfInputType::Exact(DataType::Integer)]))
+        }
+
+        fn return_field(
+            &self,
+            _: &[ArgField],
+        ) -> Result<krishiv_udf_sdk::ReturnField, krishiv_udf_sdk::UdfError> {
+            Ok(krishiv_udf_sdk::ReturnField {
+                data_type: DataType::Integer,
+                nullable: true,
+            })
+        }
+
+        fn invoke(
+            &self,
+            _: &[krishiv_udf_sdk::UdfArg<'_>],
+            _: usize,
+            _: &krishiv_udf_sdk::InvokeContext,
+        ) -> Result<arrow_array::ArrayRef, krishiv_udf_sdk::UdfError> {
+            Err(krishiv_udf_sdk::UdfError::new("test only"))
+        }
+    }
+
+    fn functions() -> SessionFunctions {
+        SessionFunctions::new(Arc::new(UdfLibrary::new()))
+    }
+
+    /// A UDF named like a built-in, for the precedence tests.
+    #[derive(Debug)]
+    struct UpperShadow;
+
+    impl ScalarUdf for UpperShadow {
+        fn name(&self) -> &str {
+            "upper"
+        }
+
+        fn version(&self) -> u32 {
+            1
+        }
+
+        fn signature(&self) -> &Signature {
+            use std::sync::OnceLock;
+            static SIG: OnceLock<Signature> = OnceLock::new();
+            SIG.get_or_init(|| Signature::Coercible(vec![UdfInputType::Exact(DataType::String)]))
+        }
+
+        fn return_field(
+            &self,
+            _: &[ArgField],
+        ) -> Result<krishiv_udf_sdk::ReturnField, krishiv_udf_sdk::UdfError> {
+            Ok(krishiv_udf_sdk::ReturnField {
+                data_type: DataType::String,
+                nullable: true,
+            })
+        }
+
+        fn invoke(
+            &self,
+            _: &[krishiv_udf_sdk::UdfArg<'_>],
+            _: usize,
+            _: &krishiv_udf_sdk::InvokeContext,
+        ) -> Result<arrow_array::ArrayRef, krishiv_udf_sdk::UdfError> {
+            Err(krishiv_udf_sdk::UdfError::new("test only"))
+        }
+    }
+
+    #[test]
+    fn bare_names_prefer_builtins() {
+        let f = functions();
+        // `upper` is a built-in: with no UDF registered, the built-in wins.
+        let found = f.lookup(&["upper".to_owned()], SparkProfile::V4_2);
+        assert!(matches!(found, FunctionLookup::Found(_)));
+        // Registering `upper` does not shadow it.
+        f.library().register(Arc::new(UpperShadow)).unwrap();
+        let found = f.lookup(&["upper".to_owned()], SparkProfile::V4_2);
+        assert!(matches!(
+            found,
+            FunctionLookup::Found(FunctionEntry {
+                id: FunctionId::Registry { .. },
+                ..
+            })
+        ));
+        // But `system.session.upper` reaches the UDF.
+        let found = f.lookup(
+            &[
+                "system".to_owned(),
+                "session".to_owned(),
+                "upper".to_owned(),
+            ],
+            SparkProfile::V4_2,
+        );
+        assert!(matches!(
+            found,
+            FunctionLookup::Found(FunctionEntry {
+                id: FunctionId::Udf { .. },
+                ..
+            })
+        ));
+        // And `system.builtin.upper` reaches the built-in only.
+        let found = f.lookup(
+            &[
+                "system".to_owned(),
+                "builtin".to_owned(),
+                "upper".to_owned(),
+            ],
+            SparkProfile::V4_2,
+        );
+        assert!(matches!(
+            found,
+            FunctionLookup::Found(FunctionEntry {
+                id: FunctionId::Registry { .. },
+                ..
+            })
+        ));
+        // `session.upper` reaches the UDF only.
+        let found = f.lookup(
+            &["session".to_owned(), "upper".to_owned()],
+            SparkProfile::V4_2,
+        );
+        assert!(matches!(
+            found,
+            FunctionLookup::Found(FunctionEntry {
+                id: FunctionId::Udf { .. },
+                ..
+            })
+        ));
+    }
+
+    #[test]
+    fn resolutions_carry_name_and_version() {
+        let f = functions();
+        assert!(matches!(
+            f.lookup(&["doubles".to_owned()], SparkProfile::V4_2),
+            FunctionLookup::NotFound
+        ));
+        f.library()
+            .register(Arc::new(Doubles { version: 2 }))
+            .unwrap();
+        let entry = match f.lookup(&["DOUBLES".to_owned()], SparkProfile::V4_2) {
+            FunctionLookup::Found(entry) => entry,
+            other => panic!("a registered UDF resolves, not {other:?}"),
+        };
+        assert_eq!(
+            entry.id,
+            FunctionId::Udf {
+                name: "doubles".to_owned(),
+                version: 2,
+            }
+        );
+        assert_eq!(entry.kind, FunctionKind::Scalar);
+        assert!(entry.arity.accepts(1) && !entry.arity.accepts(2));
+        assert!(entry.deterministic);
+        assert!(f.resolve_udf("doubles", 2).is_some());
+        assert!(f.resolve_udf("doubles", 1).is_none());
+        // Re-registering replaces and bumps the registry version.
+        let before = f.version();
+        f.library()
+            .register(Arc::new(Doubles { version: 3 }))
+            .unwrap();
+        assert!(f.version() != before);
+        let FunctionLookup::Found(entry) = f.lookup(&["doubles".to_owned()], SparkProfile::V4_2)
+        else {
+            panic!("a re-registered UDF resolves");
+        };
+        assert_eq!(
+            entry.id,
+            FunctionId::Udf {
+                name: "doubles".to_owned(),
+                version: 3,
+            }
+        );
+        assert!(f.resolve_udf("doubles", 2).is_none());
+    }
+
+    #[test]
+    fn unknown_and_qualified_builtins_resolve_as_before() {
+        let f = functions();
+        assert!(matches!(
+            f.lookup(&["nosuchfn".to_owned()], SparkProfile::V4_2),
+            FunctionLookup::NotFound
+        ));
+        // `system.builtin.nosuchfn` is not found either (built-ins only).
+        assert!(matches!(
+            f.lookup(
+                &[
+                    "system".to_owned(),
+                    "builtin".to_owned(),
+                    "nosuchfn".to_owned()
+                ],
+                SparkProfile::V4_2,
+            ),
+            FunctionLookup::NotFound
+        ));
+        // Anything else qualified is not found.
+        assert!(matches!(
+            f.lookup(&["mydb".to_owned(), "myfn".to_owned()], SparkProfile::V4_2,),
+            FunctionLookup::NotFound
+        ));
+        assert!(matches!(
+            f.lookup(
+                &[
+                    "a".to_owned(),
+                    "b".to_owned(),
+                    "c".to_owned(),
+                    "d".to_owned()
+                ],
+                SparkProfile::V4_2
+            ),
+            FunctionLookup::NotFound
+        ));
+        // Spark's determinism table still answers.
+        assert_eq!(f.spark_deterministic("upper"), Some(true));
+        let plain = BuiltinFunctions::new();
+        assert_eq!(f.version(), plain.version().wrapping_add(0));
+    }
+
+    #[test]
+    fn debug_names_the_library() {
+        let f = functions();
+        let text = format!("{f:?}");
+        assert!(text.contains("SessionFunctions"), "{text}");
+    }
+
+    /// UDFs whose trait methods panic resolve to failing entries, and the
+    /// determinism table answers from the UDFs.
+    #[derive(Debug)]
+    struct PanicVersion;
+    impl ScalarUdf for PanicVersion {
+        fn name(&self) -> &str {
+            "panic_version"
+        }
+        fn version(&self) -> u32 {
+            panic!("version went bang")
+        }
+        fn signature(&self) -> &Signature {
+            use std::sync::OnceLock;
+            static SIG: OnceLock<Signature> = OnceLock::new();
+            SIG.get_or_init(|| Signature::Exact(vec![UdfInputType::Exact(DataType::Integer)]))
+        }
+        fn return_field(
+            &self,
+            _: &[ArgField],
+        ) -> Result<krishiv_udf_sdk::ReturnField, krishiv_udf_sdk::UdfError> {
+            Ok(krishiv_udf_sdk::ReturnField {
+                data_type: DataType::Integer,
+                nullable: true,
+            })
+        }
+        fn invoke(
+            &self,
+            _: &[krishiv_udf_sdk::UdfArg<'_>],
+            _: usize,
+            _: &krishiv_udf_sdk::InvokeContext,
+        ) -> Result<arrow_array::ArrayRef, krishiv_udf_sdk::UdfError> {
+            Err(krishiv_udf_sdk::UdfError::new("test only"))
+        }
+    }
+
+    #[derive(Debug)]
+    struct PanicSig;
+    impl ScalarUdf for PanicSig {
+        fn name(&self) -> &str {
+            "panic_sig"
+        }
+        fn version(&self) -> u32 {
+            1
+        }
+        fn signature(&self) -> &Signature {
+            panic!("signature went bang")
+        }
+        fn return_field(
+            &self,
+            _: &[ArgField],
+        ) -> Result<krishiv_udf_sdk::ReturnField, krishiv_udf_sdk::UdfError> {
+            Ok(krishiv_udf_sdk::ReturnField {
+                data_type: DataType::Integer,
+                nullable: true,
+            })
+        }
+        fn invoke(
+            &self,
+            _: &[krishiv_udf_sdk::UdfArg<'_>],
+            _: usize,
+            _: &krishiv_udf_sdk::InvokeContext,
+        ) -> Result<arrow_array::ArrayRef, krishiv_udf_sdk::UdfError> {
+            Err(krishiv_udf_sdk::UdfError::new("test only"))
+        }
+    }
+
+    #[derive(Debug)]
+    struct PanicProps;
+    impl ScalarUdf for PanicProps {
+        fn name(&self) -> &str {
+            "panic_props"
+        }
+        fn version(&self) -> u32 {
+            1
+        }
+        fn signature(&self) -> &Signature {
+            use std::sync::OnceLock;
+            static SIG: OnceLock<Signature> = OnceLock::new();
+            SIG.get_or_init(|| Signature::Exact(vec![UdfInputType::Exact(DataType::Integer)]))
+        }
+        fn return_field(
+            &self,
+            _: &[ArgField],
+        ) -> Result<krishiv_udf_sdk::ReturnField, krishiv_udf_sdk::UdfError> {
+            Ok(krishiv_udf_sdk::ReturnField {
+                data_type: DataType::Integer,
+                nullable: true,
+            })
+        }
+        fn properties(&self) -> krishiv_udf_sdk::UdfProperties {
+            panic!("properties went bang")
+        }
+        fn invoke(
+            &self,
+            _: &[krishiv_udf_sdk::UdfArg<'_>],
+            _: usize,
+            _: &krishiv_udf_sdk::InvokeContext,
+        ) -> Result<arrow_array::ArrayRef, krishiv_udf_sdk::UdfError> {
+            Err(krishiv_udf_sdk::UdfError::new("test only"))
+        }
+    }
+
+    #[derive(Debug)]
+    struct FailingReturn;
+    impl ScalarUdf for FailingReturn {
+        fn name(&self) -> &str {
+            "failing_return"
+        }
+        fn version(&self) -> u32 {
+            1
+        }
+        fn signature(&self) -> &Signature {
+            use std::sync::OnceLock;
+            static SIG: OnceLock<Signature> = OnceLock::new();
+            SIG.get_or_init(|| Signature::Exact(vec![UdfInputType::Exact(DataType::Integer)]))
+        }
+        fn return_field(
+            &self,
+            _: &[ArgField],
+        ) -> Result<krishiv_udf_sdk::ReturnField, krishiv_udf_sdk::UdfError> {
+            Err(krishiv_udf_sdk::UdfError::new("no result"))
+        }
+        fn invoke(
+            &self,
+            _: &[krishiv_udf_sdk::UdfArg<'_>],
+            _: usize,
+            _: &krishiv_udf_sdk::InvokeContext,
+        ) -> Result<arrow_array::ArrayRef, krishiv_udf_sdk::UdfError> {
+            Err(krishiv_udf_sdk::UdfError::new("test only"))
+        }
+    }
+
+    #[test]
+    fn panicking_and_failing_udfs_fail_at_analysis() {
+        use krishiv_common::error::ErrorClass;
+        let f = functions();
+        for (udf, needle, deterministic) in [
+            (
+                Arc::new(PanicVersion) as Arc<dyn ScalarUdf>,
+                "version went bang",
+                Some(true),
+            ),
+            (
+                Arc::new(PanicSig) as Arc<dyn ScalarUdf>,
+                "signature went bang",
+                Some(true),
+            ),
+            (
+                Arc::new(PanicProps) as Arc<dyn ScalarUdf>,
+                "properties went bang",
+                None,
+            ),
+        ] {
+            let name = udf.name().to_lowercase();
+            f.library().register(udf).unwrap();
+            let FunctionLookup::Found(entry) =
+                f.lookup(std::slice::from_ref(&name), SparkProfile::V4_2)
+            else {
+                panic!("{name} resolves");
+            };
+            let call = CallTypes::new(&[], &[]);
+            let result = (entry.result)(&call).unwrap_err();
+            assert_eq!(result.error_class(), ErrorClass::FailedExecuteUdf, "{name}");
+            assert!(result.to_string().contains(needle), "{name}: {result}");
+            // Determinism is unknown only when `properties` panics.
+            assert_eq!(f.spark_deterministic(&name), deterministic, "{name}");
+        }
+        // A `return_field` failure also fails at analysis.
+        f.library().register(Arc::new(FailingReturn)).unwrap();
+        let FunctionLookup::Found(entry) =
+            f.lookup(&["failing_return".to_owned()], SparkProfile::V4_2)
+        else {
+            panic!("failing_return resolves");
+        };
+        let call = CallTypes::new(&[], &[]);
+        let err = (entry.result)(&call).unwrap_err();
+        assert_eq!(err.error_class(), ErrorClass::FailedExecuteUdf);
+        assert!(err.to_string().contains("no result"), "{err}");
+    }
+
+    #[test]
+    fn determinism_comes_from_the_udf_when_builtins_are_silent() {
+        let f = functions();
+        f.library()
+            .register(Arc::new(Doubles { version: 2 }))
+            .unwrap();
+        assert_eq!(f.spark_deterministic("doubles"), Some(true));
+        assert_eq!(f.spark_deterministic("nosuch"), None);
+    }
+
+    #[test]
+    fn input_forms_map_as_the_analyzer_coerces() {
+        use krishiv_plan::analyzer::{InputType, Inputs};
+        // Every current input form maps (future forms do not).
+        assert!(matches!(
+            super::to_input(&UdfInputType::Any),
+            Some(InputType::Any)
+        ));
+        assert!(matches!(
+            super::to_input(&UdfInputType::Exact(DataType::Integer)),
+            Some(InputType::Exact(_))
+        ));
+        assert!(matches!(
+            super::to_input(&UdfInputType::Strict(DataType::Integer)),
+            Some(InputType::Strict(_))
+        ));
+        assert!(matches!(
+            super::to_input(&UdfInputType::Numeric { intervals: false }),
+            Some(InputType::Numeric { .. })
+        ));
+        assert!(matches!(
+            super::to_input(&UdfInputType::Numeric { intervals: true }),
+            Some(InputType::Numeric { .. })
+        ));
+        assert!(matches!(
+            super::to_input(&UdfInputType::OneOf(vec![DataType::Integer])),
+            Some(InputType::OneOf(_))
+        ));
+        // Coercible positions match strictly.
+        assert!(matches!(
+            super::to_strict(InputType::Exact(DataType::Integer)),
+            InputType::Strict(_)
+        ));
+        assert!(matches!(super::to_strict(InputType::Any), InputType::Any));
+        // Exact and coercible arities, and variadic tails.
+        let (arity, inputs) =
+            super::signature_parts(&Signature::Exact(vec![UdfInputType::Any])).unwrap();
+        assert!(arity.accepts(1) && !arity.accepts(2));
+        assert!(matches!(inputs, Inputs::Expects(_)));
+        let (arity, _) =
+            super::signature_parts(&Signature::Coercible(vec![UdfInputType::Any])).unwrap();
+        assert!(arity.accepts(1));
+        let (arity, inputs) = super::signature_parts(&Signature::Variadic {
+            element: UdfInputType::Any,
+            min_arity: 1,
+        })
+        .unwrap();
+        assert!(!arity.accepts(0) && arity.accepts(2));
+        assert!(matches!(inputs, Inputs::Expects(_)));
+        // The fixtures expose their contracts.
+        let doubles = Doubles { version: 2 };
+        assert!(doubles.return_field(&[]).is_ok());
+        assert!(
+            doubles
+                .invoke(
+                    &[],
+                    0,
+                    &krishiv_udf_sdk::InvokeContext {
+                        partition: 0,
+                        ansi: true,
+                        time_zone: None,
+                    }
+                )
+                .is_err()
+        );
+        let shadow = UpperShadow;
+        assert!(shadow.return_field(&[]).is_ok());
+        assert!(
+            shadow
+                .invoke(
+                    &[],
+                    0,
+                    &krishiv_udf_sdk::InvokeContext {
+                        partition: 0,
+                        ansi: true,
+                        time_zone: None,
+                    }
+                )
+                .is_err()
+        );
+    }
+}
diff --git a/crates/krishiv-session/tests/udf.rs b/crates/krishiv-session/tests/udf.rs
new file mode 100644
index 000000000..a6c6f7dd9
--- /dev/null
+++ b/crates/krishiv-session/tests/udf.rs
@@ -0,0 +1,2008 @@
+// SPDX-License-Identifier: Apache-2.0
+//! Native Rust scalar UDFs end to end: registration, SQL and DataFrame
+//! calls, search-path precedence, replacement, null handling, contract
+//! errors and constant folding.
+#![cfg(test)]
+
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Arc, PoisonError};
+
+use arrow_array::cast::AsArray;
+use arrow_array::types::Int32Type;
+use arrow_array::{Array, ArrayRef, Int32Array, RecordBatch, StringArray, StringViewArray};
+use arrow_schema::{DataType as ArrowType, Field, Schema, SchemaRef};
+use futures::executor::block_on;
+use krishiv_common::error::ErrorClass;
+use krishiv_session::functions::{call_function, col};
+use krishiv_session::{
+    ArgField, InvokeContext, NullHandling, ReturnField, ScalarUdf, Session, Signature, UdfArg,
+    UdfError, UdfInputType, UdfProperties,
+};
+use krishiv_types::DataType;
+
+fn people() -> (SchemaRef, Vec<RecordBatch>) {
+    let schema = Arc::new(Schema::new(vec![
+        Field::new("id", ArrowType::Int32, false),
+        Field::new("name", ArrowType::Utf8, true),
+    ]));
+    let batch = RecordBatch::try_new(
+        Arc::clone(&schema),
+        vec![
+            Arc::new(Int32Array::from(vec![3, 1, 2])),
+            Arc::new(StringArray::from(vec![Some("c"), None, Some("b")])),
+        ],
+    )
+    .unwrap();
+    (schema, vec![batch])
+}
+
+fn session() -> Session {
+    let s = Session::new().unwrap();
+    let (schema, batches) = people();
+    s.register_batches("people", schema, batches).unwrap();
+    s
+}
+
+fn ints(batches: &[RecordBatch]) -> Vec<Option<i32>> {
+    batches
+        .iter()
+        .flat_map(|b| {
+            b.column(0)
+                .as_primitive::<Int32Type>()
+                .iter()
+                .collect::<Vec<_>>()
+        })
+        .collect()
+}
+
+fn strings(batches: &[RecordBatch]) -> Vec<Option<String>> {
+    batches
+        .iter()
+        .flat_map(|b| {
+            let column = b.column(0);
+            if let Some(view) = column.as_any().downcast_ref::<StringViewArray>() {
+                view.iter()
+                    .map(|v| v.map(str::to_owned))
+                    .collect::<Vec<_>>()
+            } else {
+                column
+                    .as_string::<i32>()
+                    .iter()
+                    .map(|v| v.map(str::to_owned))
+                    .collect::<Vec<_>>()
+            }
+        })
+        .collect()
+}
+
+fn collect(s: &Session, query: &str) -> Vec<RecordBatch> {
+    let df = block_on(s.sql(query)).unwrap();
+    block_on(df.collect()).unwrap()
+}
+
+fn int_sig() -> Signature {
+    Signature::Exact(vec![UdfInputType::Exact(DataType::Integer)])
+}
+
+/// `add_one(x) = x + 1`.
+#[derive(Debug)]
+struct AddOne;
+
+impl ScalarUdf for AddOne {
+    fn name(&self) -> &str {
+        "add_one"
+    }
+
+    fn version(&self) -> u32 {
+        1
+    }
+
+    fn signature(&self) -> &Signature {
+        use std::sync::OnceLock;
+        static SIG: OnceLock<Signature> = OnceLock::new();
+        SIG.get_or_init(int_sig)
+    }
+
+    fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+        Ok(ReturnField {
+            data_type: DataType::Integer,
+            nullable: true,
+        })
+    }
+
+    fn invoke(
+        &self,
+        args: &[UdfArg<'_>],
+        rows: usize,
+        _: &InvokeContext,
+    ) -> Result<ArrayRef, UdfError> {
+        let input = args[0].array();
+        let input = input
+            .as_any()
+            .downcast_ref::<Int32Array>()
+            .ok_or_else(|| UdfError::new("add_one needs INT"))?;
+        assert_eq!(
+            input.len(),
+            if matches!(args[0], UdfArg::Scalar(_)) {
+                1
+            } else {
+                rows
+            }
+        );
+        Ok(Arc::new(
+            input
+                .iter()
+                .map(|v| v.map(|v| v.wrapping_add(1)))
+                .collect::<Int32Array>(),
+        ))
+    }
+}
+
+#[test]
+fn a_registered_udf_runs_in_sql() {
+    let s = session();
+    s.register_udf(AddOne).unwrap();
+    let rows = collect(&s, "SELECT add_one(id) FROM people ORDER BY id");
+    assert_eq!(ints(&rows), [Some(2), Some(3), Some(4)]);
+}
+
+#[test]
+fn a_udf_runs_through_the_dataframe_api_identically() {
+    let s = session();
+    s.register_udf(AddOne).unwrap();
+    let via_sql = collect(&s, "SELECT add_one(id) AS x FROM people ORDER BY id");
+    let df = s
+        .table("people")
+        .select([call_function("add_one", [col("id")]).alias("x")]);
+    let via_df = block_on(df.order_by([col("x").asc()]).collect()).unwrap();
+    assert_eq!(ints(&via_sql), ints(&via_df));
+    assert_eq!(ints(&via_sql), [Some(2), Some(3), Some(4)]);
+}
+
+/// `upper` implemented as a UDF, shadowing the built-in by name only.
+#[derive(Debug)]
+struct UpperUdf;
+
+impl ScalarUdf for UpperUdf {
+    fn name(&self) -> &str {
+        "upper"
+    }
+
+    fn version(&self) -> u32 {
+        1
+    }
+
+    fn signature(&self) -> &Signature {
+        use std::sync::OnceLock;
+        static SIG: OnceLock<Signature> = OnceLock::new();
+        SIG.get_or_init(|| Signature::Coercible(vec![UdfInputType::Exact(DataType::String)]))
+    }
+
+    fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+        Ok(ReturnField {
+            data_type: DataType::String,
+            nullable: true,
+        })
+    }
+
+    fn invoke(
+        &self,
+        args: &[UdfArg<'_>],
+        rows: usize,
+        _: &InvokeContext,
+    ) -> Result<ArrayRef, UdfError> {
+        let input = args[0].array();
+        assert_eq!(
+            input.len(),
+            if matches!(args[0], UdfArg::Scalar(_)) {
+                1
+            } else {
+                rows
+            }
+        );
+        // String columns arrive in any UTF-8 carrier.
+        let upper = |v: Option<&str>| v.map(|v| format!("udf:{v}"));
+        if let Some(view) = input.as_any().downcast_ref::<StringViewArray>() {
+            return Ok(Arc::new(view.iter().map(upper).collect::<StringArray>()));
+        }
+        let plain = input
+            .as_any()
+            .downcast_ref::<StringArray>()
+            .ok_or_else(|| UdfError::new("upper needs STRING"))?;
+        Ok(Arc::new(plain.iter().map(upper).collect::<StringArray>()))
+    }
+}
+
+fn one_string(s: &Session, query: &str) -> String {
+    let rows = collect(s, query);
+    assert_eq!(rows.iter().map(RecordBatch::num_rows).sum::<usize>(), 1);
+    strings(&rows).into_iter().next().unwrap().unwrap()
+}
+
+#[test]
+fn builtins_win_over_a_same_name_udf() {
+    let s = Session::new().unwrap();
+    s.register_udf(UpperUdf).unwrap();
+    // The bare name is the built-in, as in Spark 4.2.
+    assert_eq!(one_string(&s, "SELECT upper('a')"), "A");
+    // `system.builtin` reaches built-ins only.
+    assert_eq!(one_string(&s, "SELECT system.builtin.upper('a')"), "A");
+    // `system.session` and `session` reach the UDF only.
+    assert_eq!(one_string(&s, "SELECT system.session.upper('a')"), "udf:a");
+    assert_eq!(one_string(&s, "SELECT session.upper('a')"), "udf:a");
+    // `system.builtin` of a UDF-only name is unknown, even with the UDF
+    // registered (a builtin-qualified call never reaches a session UDF).
+    s.register_udf(AddOne).unwrap();
+    assert_eq!(ints(&collect(&s, "SELECT add_one(41)")), [Some(42)]);
+    let e = block_on(s.sql("SELECT system.builtin.add_one(1)")).unwrap_err();
+    assert_eq!(e.error_class(), ErrorClass::UnresolvedRoutine);
+}
+
+#[test]
+fn qualified_shadowing_udf_survives_grouping_rewrites() {
+    // `analytics::retype` rebinds a call whose grouping expression was
+    // replaced by its expansion copy. Rebinding by the bare name would
+    // silently run the built-in over a same-name session UDF, so a UDF
+    // call rebinds qualified (`system.session.upper`).
+    let s = Session::new().unwrap();
+    s.register_udf(UpperUdf).unwrap();
+    let schema = Arc::new(Schema::new(vec![Field::new("s", ArrowType::Utf8, true)]));
+    let batch = RecordBatch::try_new(
+        Arc::clone(&schema),
+        vec![Arc::new(StringArray::from(vec![Some("a"), Some("b")]))],
+    )
+    .unwrap();
+    s.register_batches("t", schema, vec![batch]).unwrap();
+    for grouping in ["ROLLUP(s)", "CUBE(s)", "GROUPING SETS ((s), ())"] {
+        let query = format!("SELECT session.upper(s) AS u FROM t GROUP BY {grouping}");
+        let mut got = strings(&collect(&s, &query));
+        got.sort();
+        assert_eq!(
+            got,
+            [None, Some("udf:a".to_owned()), Some("udf:b".to_owned())],
+            "{query}"
+        );
+    }
+}
+
+#[test]
+fn unknown_functions_keep_todays_unresolved_routine() {
+    let s = Session::new().unwrap();
+    let e = block_on(s.sql("SELECT nosuchfn(1)")).unwrap_err();
+    assert_eq!(e.error_class(), ErrorClass::UnresolvedRoutine);
+    assert_eq!(e.sql_state(), Some("42883"));
+    assert_eq!(
+        e.message_parameters(),
+        [
+            ("routineName", "`nosuchfn`".to_owned()),
+            (
+                "searchPath",
+                "[`system`.`builtin`, `system`.`session`, `spark_catalog`.`default`]".to_owned()
+            ),
+        ]
+    );
+}
+
+/// `v1` then `v2`: re-registering replaces the implementation.
+#[derive(Debug)]
+struct Versioned {
+    version: u32,
+    calls: Arc<AtomicUsize>,
+}
+
+impl ScalarUdf for Versioned {
+    fn name(&self) -> &str {
+        "versioned"
+    }
+
+    fn version(&self) -> u32 {
+        self.version
+    }
+
+    fn signature(&self) -> &Signature {
+        use std::sync::OnceLock;
+        static SIG: OnceLock<Signature> = OnceLock::new();
+        SIG.get_or_init(|| Signature::Exact(Vec::new()))
+    }
+
+    fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+        Ok(ReturnField {
+            data_type: DataType::Integer,
+            nullable: false,
+        })
+    }
+
+    fn invoke(
+        &self,
+        _: &[UdfArg<'_>],
+        rows: usize,
+        _: &InvokeContext,
+    ) -> Result<ArrayRef, UdfError> {
+        self.calls.fetch_add(1, Ordering::Relaxed);
+        let version =
+            i32::try_from(self.version).map_err(|_| UdfError::new("version out of range"))?;
+        Ok(Arc::new(Int32Array::from(vec![version; rows])))
+    }
+}
+
+#[test]
+fn re_registering_a_name_replaces_it() {
+    let s = Session::new().unwrap();
+    let calls = Arc::new(AtomicUsize::new(0));
+    s.register_udf(Versioned {
+        version: 1,
+        calls: Arc::clone(&calls),
+    })
+    .unwrap();
+    let rows = collect(&s, "SELECT versioned()");
+    assert_eq!(ints(&rows), [Some(1)]);
+    // Re-registering replaces the implementation (and its version).
+    s.register_udf(Versioned {
+        version: 2,
+        calls: Arc::clone(&calls),
+    })
+    .unwrap();
+    let rows = collect(&s, "SELECT versioned()");
+    assert_eq!(ints(&rows), [Some(2)]);
+}
+
+/// A strict UDF counts its invocations; a custom one counts its nulls.
+#[derive(Debug)]
+struct NullProbe {
+    strict: bool,
+    invocations: Arc<AtomicUsize>,
+    nulls_seen: Arc<AtomicUsize>,
+}
+
+impl ScalarUdf for NullProbe {
+    fn name(&self) -> &str {
+        if self.strict {
+            "strict_probe"
+        } else {
+            "custom_probe"
+        }
+    }
+
+    fn version(&self) -> u32 {
+        1
+    }
+
+    fn signature(&self) -> &Signature {
+        use std::sync::OnceLock;
+        static SIG: OnceLock<Signature> = OnceLock::new();
+        SIG.get_or_init(int_sig)
+    }
+
+    fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+        Ok(ReturnField {
+            data_type: DataType::Integer,
+            nullable: true,
+        })
+    }
+
+    fn properties(&self) -> UdfProperties {
+        UdfProperties {
+            deterministic: true,
+            null_handling: if self.strict {
+                NullHandling::Strict
+            } else {
+                NullHandling::Custom
+            },
+        }
+    }
+
+    fn invoke(
+        &self,
+        args: &[UdfArg<'_>],
+        _rows: usize,
+        _: &InvokeContext,
+    ) -> Result<ArrayRef, UdfError> {
+        self.invocations.fetch_add(1, Ordering::Relaxed);
+        let input = args[0]
+            .array()
+            .as_any()
+            .downcast_ref::<Int32Array>()
+            .ok_or_else(|| UdfError::new("probe needs INT"))?
+            .clone();
+        self.nulls_seen
+            .fetch_add(input.null_count(), Ordering::Relaxed);
+        if self.strict {
+            assert_eq!(input.null_count(), 0, "a strict UDF never sees a null");
+        }
+        Ok(Arc::new(input))
+    }
+}
+
+#[test]
+fn strict_never_sees_nulls_custom_does() {
+    let s = Session::new().unwrap();
+    let schema = Arc::new(Schema::new(vec![Field::new("a", ArrowType::Int32, true)]));
+    let batch = RecordBatch::try_new(
+        Arc::clone(&schema),
+        vec![Arc::new(Int32Array::from(vec![Some(1), None, Some(3)]))],
+    )
+    .unwrap();
+    s.register_batches("nums", schema, vec![batch]).unwrap();
+    let strict_calls = Arc::new(AtomicUsize::new(0));
+    let strict_nulls = Arc::new(AtomicUsize::new(0));
+    let custom_calls = Arc::new(AtomicUsize::new(0));
+    let custom_nulls = Arc::new(AtomicUsize::new(0));
+    s.register_udf(NullProbe {
+        strict: true,
+        invocations: Arc::clone(&strict_calls),
+        nulls_seen: Arc::clone(&strict_nulls),
+    })
+    .unwrap();
+    s.register_udf(NullProbe {
+        strict: false,
+        invocations: Arc::clone(&custom_calls),
+        nulls_seen: Arc::clone(&custom_nulls),
+    })
+    .unwrap();
+    // `a` is `[1, NULL, 3]`.
+    let rows = collect(
+        &s,
+        "SELECT strict_probe(a), custom_probe(a) FROM nums ORDER BY a",
+    );
+    assert_eq!(rows.iter().map(RecordBatch::num_rows).sum::<usize>(), 3);
+    // The null row is null without invoking under Strict; Custom sees it.
+    assert_eq!(strict_nulls.load(Ordering::Relaxed), 0);
+    assert_eq!(custom_nulls.load(Ordering::Relaxed), 1);
+    let first: Vec<Option<i32>> = rows
+        .iter()
+        .flat_map(|b| {
+            b.column(0)
+                .as_primitive::<Int32Type>()
+                .iter()
+                .collect::<Vec<_>>()
+        })
+        .collect();
+    let second: Vec<Option<i32>> = rows
+        .iter()
+        .flat_map(|b| {
+            b.column(1)
+                .as_primitive::<Int32Type>()
+                .iter()
+                .collect::<Vec<_>>()
+        })
+        .collect();
+    assert_eq!(first, [None, Some(1), Some(3)]);
+    assert_eq!(second, [None, Some(1), Some(3)]);
+}
+
+/// Records the row counts it is invoked with.
+#[derive(Debug)]
+struct RowRecorder {
+    rows: Arc<std::sync::Mutex<Vec<usize>>>,
+}
+
+impl ScalarUdf for RowRecorder {
+    fn name(&self) -> &str {
+        "recorder"
+    }
+
+    fn version(&self) -> u32 {
+        1
+    }
+
+    fn signature(&self) -> &Signature {
+        use std::sync::OnceLock;
+        static SIG: OnceLock<Signature> = OnceLock::new();
+        SIG.get_or_init(|| {
+            Signature::Exact(vec![
+                UdfInputType::Exact(DataType::Integer),
+                UdfInputType::Exact(DataType::Integer),
+            ])
+        })
+    }
+
+    fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+        Ok(ReturnField {
+            data_type: DataType::Integer,
+            nullable: false,
+        })
+    }
+
+    fn invoke(
+        &self,
+        _: &[UdfArg<'_>],
+        rows: usize,
+        _: &InvokeContext,
+    ) -> Result<ArrayRef, UdfError> {
+        self.rows
+            .lock()
+            .unwrap_or_else(PoisonError::into_inner)
+            .push(rows);
+        Ok(Arc::new(Int32Array::from(vec![1; rows])))
+    }
+}
+
+#[test]
+fn all_literal_calls_invoke_once_and_broadcast() {
+    let s = session();
+    let seen = Arc::new(std::sync::Mutex::new(Vec::new()));
+    s.register_udf(RowRecorder {
+        rows: Arc::clone(&seen),
+    })
+    .unwrap();
+    // Two literal arguments over three rows: computed once, broadcast.
+    let rows = collect(&s, "SELECT recorder(1, 2) FROM people");
+    assert_eq!(ints(&rows), [Some(1), Some(1), Some(1)]);
+    assert_eq!(seen.lock().unwrap().as_slice(), [1]);
+}
+
+/// A UDF echoing its string argument, for implicit-cast parity.
+#[derive(Debug)]
+struct EchoString;
+
+impl ScalarUdf for EchoString {
+    fn name(&self) -> &str {
+        "echo_str"
+    }
+
+    fn version(&self) -> u32 {
+        1
+    }
+
+    fn signature(&self) -> &Signature {
+        use std::sync::OnceLock;
+        static SIG: OnceLock<Signature> = OnceLock::new();
+        SIG.get_or_init(|| Signature::Exact(vec![UdfInputType::Exact(DataType::String)]))
+    }
+
+    fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+        Ok(ReturnField {
+            data_type: DataType::String,
+            nullable: true,
+        })
+    }
+
+    fn invoke(
+        &self,
+        args: &[UdfArg<'_>],
+        rows: usize,
+        _: &InvokeContext,
+    ) -> Result<ArrayRef, UdfError> {
+        let input = args[0].array();
+        assert_eq!(
+            input.len(),
+            if matches!(args[0], UdfArg::Scalar(_)) {
+                1
+            } else {
+                rows
+            }
+        );
+        if let Some(view) = input.as_any().downcast_ref::<StringViewArray>() {
+            return Ok(Arc::new(view.iter().collect::<StringArray>()));
+        }
+        let plain = input
+            .as_any()
+            .downcast_ref::<StringArray>()
+            .ok_or_else(|| UdfError::new("echo_str needs STRING"))?;
+        Ok(Arc::new(plain.clone()))
+    }
+}
+
+#[test]
+fn implicit_casts_match_a_builtin_with_the_same_inputs() {
+    let s = Session::new().unwrap();
+    s.register_udf(EchoString).unwrap();
+    // `INT` implicitly casts to `STRING`, exactly as for the built-in
+    // `upper` with the same declared input.
+    assert_eq!(one_string(&s, "SELECT echo_str(1)"), "1");
+    assert_eq!(one_string(&s, "SELECT upper(1)"), "1");
+}
+
+/// A UDF with coercible (strict) integer input.
+#[derive(Debug)]
+struct StrictInt;
+
+impl ScalarUdf for StrictInt {
+    fn name(&self) -> &str {
+        "strict_int"
+    }
+
+    fn version(&self) -> u32 {
+        1
+    }
+
+    fn signature(&self) -> &Signature {
+        use std::sync::OnceLock;
+        static SIG: OnceLock<Signature> = OnceLock::new();
+        SIG.get_or_init(|| Signature::Coercible(vec![UdfInputType::Exact(DataType::Integer)]))
+    }
+
+    fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+        Ok(ReturnField {
+            data_type: DataType::Integer,
+            nullable: true,
+        })
+    }
+
+    fn invoke(
+        &self,
+        args: &[UdfArg<'_>],
+        rows: usize,
+        _: &InvokeContext,
+    ) -> Result<ArrayRef, UdfError> {
+        let input = args[0].array();
+        let input = input
+            .as_any()
+            .downcast_ref::<Int32Array>()
+            .ok_or_else(|| UdfError::new("strict_int needs INT"))?;
+        assert_eq!(
+            input.len(),
+            if matches!(args[0], UdfArg::Scalar(_)) {
+                1
+            } else {
+                rows
+            }
+        );
+        Ok(Arc::new(input.clone()))
+    }
+}
+
+#[test]
+fn coercible_positions_match_strictly() {
+    let s = Session::new().unwrap();
+    s.register_udf(AddOne).unwrap();
+    s.register_udf(StrictInt).unwrap();
+    // `Exact` coerces a `BIGINT` down to `INT`.
+    let rows = collect(&s, "SELECT add_one(CAST(5 AS BIGINT))");
+    assert_eq!(ints(&rows), [Some(6)]);
+    // `Coercible` does not: a `BIGINT` is the wrong input type.
+    let e = block_on(s.sql("SELECT strict_int(CAST(5 AS BIGINT))")).unwrap_err();
+    assert_eq!(
+        e.error_class(),
+        ErrorClass::DatatypeMismatchUnexpectedInputType
+    );
+}
+
+/// A failing, panicking or contract-breaking UDF.
+#[derive(Debug)]
+struct Explosive {
+    what: &'static str,
+}
+
+impl ScalarUdf for Explosive {
+    fn name(&self) -> &str {
+        match self.what {
+            "short" => "short_result",
+            "type" => "explosive_type",
+            "nullable" => "explosive_nullable",
+            "error" => "explosive_error",
+            _ => "explosive_panic",
+        }
+    }
+
+    fn version(&self) -> u32 {
+        1
+    }
+
+    fn signature(&self) -> &Signature {
+        use std::sync::OnceLock;
+        static SIG: OnceLock<Signature> = OnceLock::new();
+        SIG.get_or_init(int_sig)
+    }
+
+    fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+        Ok(ReturnField {
+            data_type: DataType::Integer,
+            // Never nullable: a null result is a contract break.
+            nullable: false,
+        })
+    }
+
+    fn invoke(
+        &self,
+        args: &[UdfArg<'_>],
+        rows: usize,
+        _: &InvokeContext,
+    ) -> Result<ArrayRef, UdfError> {
+        match self.what {
+            "type" => Ok(Arc::new(StringArray::from(vec!["x"; rows]))),
+            "short" => Ok(Arc::new(Int32Array::from(vec![Some(1)]))),
+            "nullable" => Ok(Arc::new(Int32Array::from(vec![None; rows]))),
+            "error" => Err(UdfError::new("cannot compute this")),
+            "panic" => panic!("udf went bang"),
+            _ => {
+                let input = args[0].array();
+                Ok(input)
+            }
+        }
+    }
+}
+
+fn explosive_fails(s: &Session, query: &str, reason: &str) {
+    let df = block_on(s.sql(query)).unwrap();
+    let e = block_on(df.collect()).unwrap_err();
+    assert_eq!(e.error_class(), ErrorClass::FailedExecuteUdf, "{query}");
+    assert_eq!(e.sql_state(), Some("39000"), "{query}");
+    let text = e.to_string();
+    assert!(text.contains(reason), "{query}: {text}");
+}
+
+#[test]
+fn contract_breaks_user_errors_and_panics_fail_the_query() {
+    let s = session();
+    for what in ["type", "nullable", "error", "panic"] {
+        s.register_udf(Explosive { what }).unwrap();
+    }
+    s.register_udf(Explosive { what: "short" }).unwrap();
+    // Wrong result type, nullability, user error and panic.
+    explosive_fails(&s, "SELECT explosive_type(1)", "explosive_type");
+    explosive_fails(&s, "SELECT explosive_nullable(1)", "explosive_nullable");
+    explosive_fails(&s, "SELECT explosive_error(1)", "cannot compute this");
+    explosive_fails(&s, "SELECT explosive_panic(1)", "udf went bang");
+    // Wrong result length: one row for three (a column argument, so no
+    // all-literal broadcast hides it).
+    let df = block_on(s.sql("SELECT short_result(id) FROM people")).unwrap();
+    let e = block_on(df.collect()).unwrap_err();
+    assert_eq!(e.error_class(), ErrorClass::FailedExecuteUdf);
+    assert!(e.to_string().contains("short_result"), "{e}");
+    // The wrong arity never reaches the UDF.
+    let e = block_on(s.sql("SELECT short_result(1, 2)")).unwrap_err();
+    assert_eq!(e.error_class(), ErrorClass::WrongNumArgsWithoutSuggestion);
+}
+
+/// A counting echo: deterministic or not.
+#[derive(Debug)]
+struct CountingEcho {
+    deterministic: bool,
+    calls: Arc<AtomicUsize>,
+}
+
+impl ScalarUdf for CountingEcho {
+    fn name(&self) -> &str {
+        if self.deterministic {
+            "det_echo"
+        } else {
+            "nondet_echo"
+        }
+    }
+
+    fn version(&self) -> u32 {
+        1
+    }
+
+    fn signature(&self) -> &Signature {
+        use std::sync::OnceLock;
+        static SIG: OnceLock<Signature> = OnceLock::new();
+        SIG.get_or_init(|| Signature::Exact(vec![UdfInputType::Exact(DataType::String)]))
+    }
+
+    fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+        Ok(ReturnField {
+            data_type: DataType::String,
+            nullable: true,
+        })
+    }
+
+    fn properties(&self) -> UdfProperties {
+        UdfProperties {
+            deterministic: self.deterministic,
+            null_handling: NullHandling::Strict,
+        }
+    }
+
+    fn invoke(
+        &self,
+        args: &[UdfArg<'_>],
+        rows: usize,
+        _: &InvokeContext,
+    ) -> Result<ArrayRef, UdfError> {
+        use arrow_array::{StringArray, StringViewArray};
+        self.calls.fetch_add(1, Ordering::Relaxed);
+        let input = args[0].array();
+        assert_eq!(
+            input.len(),
+            if matches!(args[0], UdfArg::Scalar(_)) {
+                1
+            } else {
+                rows
+            }
+        );
+        if let Some(view) = input.as_any().downcast_ref::<StringViewArray>() {
+            return Ok(Arc::new(view.iter().collect::<StringArray>()));
+        }
+        let plain = input
+            .as_any()
+            .downcast_ref::<StringArray>()
+            .ok_or_else(|| UdfError::new("echo needs STRING"))?;
+        Ok(Arc::new(plain.clone()))
+    }
+}
+
+#[test]
+fn only_deterministic_calls_fold() {
+    let s = Session::new().unwrap();
+    let nondet_calls = Arc::new(AtomicUsize::new(0));
+    s.register_udf(CountingEcho {
+        deterministic: true,
+        calls: Arc::new(AtomicUsize::new(0)),
+    })
+    .unwrap();
+    s.register_udf(CountingEcho {
+        deterministic: false,
+        calls: Arc::clone(&nondet_calls),
+    })
+    .unwrap();
+    // The deterministic call folds to a literal: the plan holds `'a'`,
+    // not the call (the output name still cites it, as for built-ins).
+    let plan = explain(&s, "SELECT det_echo('a')");
+    assert!(plan.contains("'a' AS"), "{plan}");
+    assert!(!plan.contains("det_echo('a')"), "{plan}");
+    assert_eq!(one_string(&s, "SELECT det_echo('a')"), "a");
+    // The nondeterministic call stays in the plan and runs.
+    let plan = explain(&s, "SELECT nondet_echo('a')");
+    assert!(plan.contains("nondet_echo('a')"), "{plan}");
+    assert_eq!(one_string(&s, "SELECT nondet_echo('a')"), "a");
+    assert!(nondet_calls.load(Ordering::Relaxed) >= 1);
+}
+
+fn explain(s: &Session, query: &str) -> String {
+    let df = block_on(s.sql(&format!("EXPLAIN {query}"))).unwrap();
+    let rows = block_on(df.collect()).unwrap();
+    let mut out = String::new();
+    for b in &rows {
+        for c in b.columns() {
+            if let Some(view) = c.as_any().downcast_ref::<StringViewArray>() {
+                for v in view.iter().flatten() {
+                    out.push_str(v);
+                    out.push('\n');
+                }
+            }
+            if let Some(plain) = c.as_any().downcast_ref::<StringArray>() {
+                for v in plain.iter().flatten() {
+                    out.push_str(v);
+                    out.push('\n');
+                }
+            }
+        }
+    }
+    out
+}
+
+/// A variadic string join.
+#[derive(Debug)]
+struct JoinStrings;
+
+impl ScalarUdf for JoinStrings {
+    fn name(&self) -> &str {
+        "join_strings"
+    }
+
+    fn version(&self) -> u32 {
+        1
+    }
+
+    fn signature(&self) -> &Signature {
+        use std::sync::OnceLock;
+        static SIG: OnceLock<Signature> = OnceLock::new();
+        SIG.get_or_init(|| Signature::Variadic {
+            element: UdfInputType::Exact(DataType::String),
+            min_arity: 1,
+        })
+    }
+
+    fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+        Ok(ReturnField {
+            data_type: DataType::String,
+            nullable: true,
+        })
+    }
+
+    fn invoke(
+        &self,
+        args: &[UdfArg<'_>],
+        rows: usize,
+        _: &InvokeContext,
+    ) -> Result<ArrayRef, UdfError> {
+        use arrow_array::{StringArray, StringViewArray};
+        fn text(arg: &ArrayRef) -> Result<Vec<Option<String>>, UdfError> {
+            if let Some(view) = arg.as_any().downcast_ref::<StringViewArray>() {
+                return Ok(view.iter().map(|v| v.map(str::to_owned)).collect());
+            }
+            arg.as_any()
+                .downcast_ref::<StringArray>()
+                .ok_or_else(|| UdfError::new("join_strings needs STRING"))
+                .map(|a| a.iter().map(|v| v.map(str::to_owned)).collect())
+        }
+        let columns: Vec<Vec<Option<String>>> = args
+            .iter()
+            .map(|a| text(&a.array()))
+            .collect::<Result<_, _>>()?;
+        let mut out = Vec::with_capacity(rows);
+        for i in 0..rows {
+            let mut parts = Vec::new();
+            for (j, column) in columns.iter().enumerate() {
+                let at = if column.len() == 1 { 0 } else { i };
+                match column.get(at) {
+                    Some(Some(v)) => parts.push(v.clone()),
+                    _ => parts.push(format!("<null{j}>")),
+                }
+            }
+            out.push(Some(parts.join(",")));
+        }
+        Ok(Arc::new(StringArray::from(out)))
+    }
+}
+
+#[test]
+fn variadic_udfs_take_any_arity_above_the_minimum() {
+    let s = Session::new().unwrap();
+    s.register_udf(JoinStrings).unwrap();
+    assert_eq!(one_string(&s, "SELECT join_strings('a')"), "a");
+    assert_eq!(
+        one_string(&s, "SELECT join_strings('a', 'b', 'c')"),
+        "a,b,c"
+    );
+    let e = block_on(s.sql("SELECT join_strings()")).unwrap_err();
+    assert_eq!(e.error_class(), ErrorClass::WrongNumArgsWithoutSuggestion);
+}
+
+/// A strict UDF declaring non-nullable results, over a nullable column.
+#[derive(Debug)]
+struct StrictNonNull;
+
+impl ScalarUdf for StrictNonNull {
+    fn name(&self) -> &str {
+        "strict_nonnull"
+    }
+
+    fn version(&self) -> u32 {
+        1
+    }
+
+    fn signature(&self) -> &Signature {
+        use std::sync::OnceLock;
+        static SIG: OnceLock<Signature> = OnceLock::new();
+        SIG.get_or_init(int_sig)
+    }
+
+    fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+        Ok(ReturnField {
+            data_type: DataType::Integer,
+            nullable: false,
+        })
+    }
+
+    fn invoke(
+        &self,
+        args: &[UdfArg<'_>],
+        rows: usize,
+        _: &InvokeContext,
+    ) -> Result<ArrayRef, UdfError> {
+        let input = args[0].array();
+        let input = input
+            .as_any()
+            .downcast_ref::<Int32Array>()
+            .ok_or_else(|| UdfError::new("strict_nonnull needs INT"))?;
+        assert_eq!(input.null_count(), 0, "a strict UDF never sees a null");
+        assert_eq!(
+            input.len(),
+            if matches!(args[0], UdfArg::Scalar(_)) {
+                1
+            } else {
+                rows
+            }
+        );
+        Ok(Arc::new(input.clone()))
+    }
+}
+
+#[test]
+fn strict_non_nullable_declared_udf_widens_over_nullable_args() {
+    let s = Session::new().unwrap();
+    let schema = Arc::new(Schema::new(vec![Field::new("a", ArrowType::Int32, true)]));
+    let batch = RecordBatch::try_new(
+        Arc::clone(&schema),
+        vec![Arc::new(Int32Array::from(vec![Some(1), None, Some(3)]))],
+    )
+    .unwrap();
+    s.register_batches("nums", schema, vec![batch]).unwrap();
+    s.register_udf(StrictNonNull).unwrap();
+    // The analyzer widens the result to nullable: the field accepts nulls.
+    let df = block_on(s.sql("SELECT strict_nonnull(a) AS x FROM nums")).unwrap();
+    let schema = block_on(df.schema()).unwrap();
+    assert!(schema.field(0).is_nullable(), "strict widens to nullable");
+    let rows = block_on(df.collect()).unwrap();
+    let values: Vec<Option<i32>> = rows
+        .iter()
+        .flat_map(|b| {
+            b.column(0)
+                .as_primitive::<Int32Type>()
+                .iter()
+                .collect::<Vec<_>>()
+        })
+        .collect();
+    // Order is not guaranteed without ORDER BY; sort for determinism.
+    let mut sorted = values;
+    sorted.sort();
+    assert_eq!(sorted, [None, Some(1), Some(3)]);
+}
+
+/// A session UDF named like the built-in `nvl`: strict, so a null input
+/// gives null, while the built-in coalesces.
+#[derive(Debug)]
+struct NvlUdf;
+
+impl ScalarUdf for NvlUdf {
+    fn name(&self) -> &str {
+        "nvl"
+    }
+
+    fn version(&self) -> u32 {
+        1
+    }
+
+    fn signature(&self) -> &Signature {
+        use std::sync::OnceLock;
+        static SIG: OnceLock<Signature> = OnceLock::new();
+        SIG.get_or_init(|| {
+            Signature::Exact(vec![
+                UdfInputType::Exact(DataType::Integer),
+                UdfInputType::Exact(DataType::Integer),
+            ])
+        })
+    }
+
+    fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+        Ok(ReturnField {
+            data_type: DataType::Integer,
+            nullable: true,
+        })
+    }
+
+    fn invoke(
+        &self,
+        args: &[UdfArg<'_>],
+        _rows: usize,
+        _: &InvokeContext,
+    ) -> Result<ArrayRef, UdfError> {
+        let first = args[0].array();
+        let first = first
+            .as_any()
+            .downcast_ref::<Int32Array>()
+            .ok_or_else(|| UdfError::new("nvl needs INT"))?;
+        // Markedly not `coalesce`: adds a thousand to the first argument.
+        Ok(Arc::new(
+            first
+                .iter()
+                .map(|v| v.map(|v| v.wrapping_add(1000)))
+                .collect::<Int32Array>(),
+        ))
+    }
+}
+
+fn nvl_table() -> Session {
+    let s = Session::new().unwrap();
+    let schema = Arc::new(Schema::new(vec![Field::new("a", ArrowType::Int32, true)]));
+    let batch = RecordBatch::try_new(
+        Arc::clone(&schema),
+        vec![Arc::new(Int32Array::from(vec![None, Some(1)]))],
+    )
+    .unwrap();
+    s.register_batches("t", schema, vec![batch]).unwrap();
+    s.register_udf(NvlUdf).unwrap();
+    s
+}
+
+#[test]
+fn nvl_builtin_wins_unqualified_but_qualified_reaches_the_udf() {
+    let s = nvl_table();
+    // SQL: bare `nvl` is the built-in (`coalesce`); qualified reaches the UDF.
+    let rows = collect(&s, "SELECT nvl(a, 0) AS x FROM t ORDER BY a");
+    // Built-in: NULL -> 0, 1 -> 1. `ORDER BY a` is nulls first: [0, 1].
+    assert_eq!(ints(&rows), [Some(0), Some(1)]);
+    let rows = collect(&s, "SELECT session.nvl(a, 0) AS x FROM t ORDER BY a");
+    // UDF (strict): NULL -> NULL, 1 -> 1001.
+    assert_eq!(ints(&rows), [None, Some(1001)]);
+    let rows = collect(&s, "SELECT system.session.nvl(a, 0) AS x FROM t ORDER BY a");
+    assert_eq!(ints(&rows), [None, Some(1001)]);
+    // DataFrame API follows the same rule.
+    let df = s
+        .table("t")
+        .select([call_function("nvl", [col("a"), 0.into()]).alias("x")]);
+    let via_df = block_on(df.order_by([col("x").asc()]).collect()).unwrap();
+    assert_eq!(ints(&via_df), [Some(0), Some(1)]);
+    let df = s
+        .table("t")
+        .select([call_function("session.nvl", [col("a"), 0.into()]).alias("x")]);
+    let via_df = block_on(df.order_by([col("x").asc()]).collect()).unwrap();
+    // NULL sorts first ascending: [NULL, 1001].
+    assert_eq!(ints(&via_df), [None, Some(1001)]);
+    let df = s
+        .table("t")
+        .select([call_function("system.session.nvl", [col("a"), 0.into()]).alias("x")]);
+    let via_df = block_on(df.order_by([col("x").asc()]).collect()).unwrap();
+    assert_eq!(ints(&via_df), [None, Some(1001)]);
+}
+
+/// A session UDF named like the built-in `assert_true`: returns NOT cond,
+/// never raising, while the built-in raises on false.
+#[derive(Debug)]
+struct AssertTrueUdf;
+
+impl ScalarUdf for AssertTrueUdf {
+    fn name(&self) -> &str {
+        "assert_true"
+    }
+
+    fn version(&self) -> u32 {
+        1
+    }
+
+    fn signature(&self) -> &Signature {
+        use std::sync::OnceLock;
+        static SIG: OnceLock<Signature> = OnceLock::new();
+        SIG.get_or_init(|| Signature::Exact(vec![UdfInputType::Exact(DataType::Boolean)]))
+    }
+
+    fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+        Ok(ReturnField {
+            data_type: DataType::Boolean,
+            nullable: true,
+        })
+    }
+
+    fn invoke(
+        &self,
+        args: &[UdfArg<'_>],
+        rows: usize,
+        _: &InvokeContext,
+    ) -> Result<ArrayRef, UdfError> {
+        use arrow_array::BooleanArray;
+        let input = args[0].array();
+        let input = input
+            .as_any()
+            .downcast_ref::<BooleanArray>()
+            .ok_or_else(|| UdfError::new("assert_true needs BOOLEAN"))?;
+        assert_eq!(
+            input.len(),
+            if matches!(args[0], UdfArg::Scalar(_)) {
+                1
+            } else {
+                rows
+            }
+        );
+        Ok(Arc::new(
+            input
+                .iter()
+                .map(|v| v.map(|v| !v))
+                .collect::<BooleanArray>(),
+        ))
+    }
+}
+
+fn bools(batches: &[RecordBatch]) -> Vec<Option<bool>> {
+    use arrow_array::BooleanArray;
+    batches
+        .iter()
+        .flat_map(|b| {
+            b.column(0)
+                .as_any()
+                .downcast_ref::<BooleanArray>()
+                .unwrap()
+                .iter()
+                .collect::<Vec<_>>()
+        })
+        .collect()
+}
+
+#[test]
+fn assert_true_builtin_wins_unqualified_but_qualified_reaches_the_udf() {
+    let s = Session::new().unwrap();
+    s.register_udf(AssertTrueUdf).unwrap();
+    // SQL: bare `assert_true(true)` is the built-in (`void`, always NULL);
+    // qualified runs the UDF (NOT cond, boolean).
+    let rows = collect(&s, "SELECT assert_true(true) AS x");
+    assert_eq!(rows.iter().map(RecordBatch::num_rows).sum::<usize>(), 1);
+    // `void` travels as `Null`: one null row.
+    assert_eq!(rows[0].column(0).data_type(), &ArrowType::Null);
+    let rows = collect(&s, "SELECT session.assert_true(true) AS x");
+    assert_eq!(bools(&rows), [Some(false)]);
+    let rows = collect(&s, "SELECT system.session.assert_true(false) AS x");
+    assert_eq!(bools(&rows), [Some(true)]);
+    // DataFrame API follows the same rule, through a real table.
+    let s2 = Session::new().unwrap();
+    s2.register_udf(AssertTrueUdf).unwrap();
+    let schema = Arc::new(Schema::new(vec![Field::new(
+        "b",
+        ArrowType::Boolean,
+        false,
+    )]));
+    let batch = RecordBatch::try_new(
+        Arc::clone(&schema),
+        vec![Arc::new(arrow_array::BooleanArray::from(vec![true]))],
+    )
+    .unwrap();
+    s2.register_batches("b", schema, vec![batch]).unwrap();
+    let df = s2
+        .table("b")
+        .select([call_function("assert_true", [col("b")]).alias("x")]);
+    let rows = block_on(df.collect()).unwrap();
+    assert_eq!(rows.iter().map(RecordBatch::num_rows).sum::<usize>(), 1);
+    assert_eq!(rows[0].column(0).data_type(), &ArrowType::Null);
+    let df = s2
+        .table("b")
+        .select([call_function("session.assert_true", [col("b")]).alias("x")]);
+    assert_eq!(bools(&block_on(df.collect()).unwrap()), [Some(false)]);
+    let df = s2
+        .table("b")
+        .select([call_function("system.session.assert_true", [col("b")]).alias("x")]);
+    assert_eq!(bools(&block_on(df.collect()).unwrap()), [Some(false)]);
+}
+
+/// A scalar session UDF named like the window function `ntile`.
+#[derive(Debug)]
+struct NtileUdf;
+
+impl ScalarUdf for NtileUdf {
+    fn name(&self) -> &str {
+        "ntile"
+    }
+
+    fn version(&self) -> u32 {
+        1
+    }
+
+    fn signature(&self) -> &Signature {
+        use std::sync::OnceLock;
+        static SIG: OnceLock<Signature> = OnceLock::new();
+        SIG.get_or_init(int_sig)
+    }
+
+    fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+        Ok(ReturnField {
+            data_type: DataType::Integer,
+            nullable: true,
+        })
+    }
+
+    fn invoke(
+        &self,
+        args: &[UdfArg<'_>],
+        rows: usize,
+        _: &InvokeContext,
+    ) -> Result<ArrayRef, UdfError> {
+        // Adds 100 whatever the argument shape is: a qualified session UDF
+        // named like a built-in keeps its arguments as written (only the
+        // built-in folds its bucket count to a literal; see
+        // `folded_ntile_only_folds_for_builtins` in `krishiv-plan`, where
+        // the analyzer-level difference is checked — the optimizer folds
+        // `1 + 1` either way, so results agree here).
+        let input = args[0].array();
+        let input = input
+            .as_any()
+            .downcast_ref::<Int32Array>()
+            .ok_or_else(|| UdfError::new("ntile needs INT"))?;
+        assert_eq!(
+            input.len(),
+            if matches!(args[0], UdfArg::Scalar(_)) {
+                1
+            } else {
+                rows
+            }
+        );
+        Ok(Arc::new(
+            input
+                .iter()
+                .map(|v| v.map(|v| v.wrapping_add(100)))
+                .collect::<Int32Array>(),
+        ))
+    }
+}
+
+#[test]
+fn ntile_qualified_reaches_the_udf_unqualified_stays_the_window() {
+    let s = Session::new().unwrap();
+    s.register_udf(NtileUdf).unwrap();
+    // SQL: qualified calls run the scalar UDF.
+    let rows = collect(&s, "SELECT session.ntile(5) AS x");
+    assert_eq!(ints(&rows), [Some(105)]);
+    let rows = collect(&s, "SELECT system.session.ntile(5) AS x");
+    assert_eq!(ints(&rows), [Some(105)]);
+    // Unqualified `ntile` stays the window function: without OVER it fails
+    // as the built-in does, never running the UDF.
+    let e = block_on(s.sql("SELECT ntile(5)")).unwrap_err();
+    assert_ne!(e.error_class(), ErrorClass::FailedExecuteUdf);
+    // DataFrame API follows the same rule.
+    let s2 = Session::new().unwrap();
+    s2.register_udf(NtileUdf).unwrap();
+    let schema = Arc::new(Schema::new(vec![Field::new("a", ArrowType::Int32, false)]));
+    let batch = RecordBatch::try_new(
+        Arc::clone(&schema),
+        vec![Arc::new(Int32Array::from(vec![5]))],
+    )
+    .unwrap();
+    s2.register_batches("n", schema, vec![batch]).unwrap();
+    let df = s2
+        .table("n")
+        .select([call_function("session.ntile", [col("a")]).alias("x")]);
+    assert_eq!(ints(&block_on(df.collect()).unwrap()), [Some(105)]);
+    let df = s2
+        .table("n")
+        .select([call_function("system.session.ntile", [col("a")]).alias("x")]);
+    assert_eq!(ints(&block_on(df.collect()).unwrap()), [Some(105)]);
+}
+
+/// A UDF whose `return_field` panics.
+#[derive(Debug)]
+struct PanicReturn;
+
+impl ScalarUdf for PanicReturn {
+    fn name(&self) -> &str {
+        "panic_return"
+    }
+
+    fn version(&self) -> u32 {
+        1
+    }
+
+    fn signature(&self) -> &Signature {
+        use std::sync::OnceLock;
+        static SIG: OnceLock<Signature> = OnceLock::new();
+        SIG.get_or_init(int_sig)
+    }
+
+    fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+        panic!("return_field went bang");
+    }
+
+    fn invoke(
+        &self,
+        _: &[UdfArg<'_>],
+        rows: usize,
+        _: &InvokeContext,
+    ) -> Result<ArrayRef, UdfError> {
+        Ok(Arc::new(Int32Array::from(vec![1; rows])))
+    }
+}
+
+/// A UDF whose `signature` panics.
+#[derive(Debug)]
+struct PanicSignature;
+
+impl ScalarUdf for PanicSignature {
+    fn name(&self) -> &str {
+        "panic_signature"
+    }
+
+    fn version(&self) -> u32 {
+        1
+    }
+
+    fn signature(&self) -> &Signature {
+        panic!("signature went bang");
+    }
+
+    fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+        Ok(ReturnField {
+            data_type: DataType::Integer,
+            nullable: true,
+        })
+    }
+
+    fn invoke(
+        &self,
+        _: &[UdfArg<'_>],
+        rows: usize,
+        _: &InvokeContext,
+    ) -> Result<ArrayRef, UdfError> {
+        Ok(Arc::new(Int32Array::from(vec![1; rows])))
+    }
+}
+
+#[test]
+fn panicking_return_field_and_signature_become_failed_execute_udf() {
+    let s = Session::new().unwrap();
+    s.register_udf(PanicReturn).unwrap();
+    s.register_udf(PanicSignature).unwrap();
+    for query in ["SELECT panic_return(1)", "SELECT panic_signature(1)"] {
+        let e = block_on(s.sql(query)).unwrap_err();
+        assert_eq!(e.error_class(), ErrorClass::FailedExecuteUdf, "{query}");
+        assert_eq!(e.sql_state(), Some("39000"), "{query}");
+        assert!(e.to_string().contains("went bang"), "{query}: {e}");
+    }
+    // DataFrame calls fail the same way, through a real table.
+    let schema = Arc::new(Schema::new(vec![Field::new("a", ArrowType::Int32, false)]));
+    let batch = RecordBatch::try_new(
+        Arc::clone(&schema),
+        vec![Arc::new(Int32Array::from(vec![1]))],
+    )
+    .unwrap();
+    s.register_batches("p", schema, vec![batch]).unwrap();
+    let df = s
+        .table("p")
+        .select([call_function("panic_return", [col("a")])]);
+    let e = block_on(df.collect()).unwrap_err();
+    assert_eq!(e.error_class(), ErrorClass::FailedExecuteUdf);
+}
+
+#[test]
+fn udf_not_available_uses_39000() {
+    use krishiv_common::error::ErrorClass;
+    assert_eq!(
+        ErrorClass::KrishivUdfNotAvailable.sql_state(),
+        Some("39000")
+    );
+}
+
+/// A UDF whose `name` panics: registration fails with
+/// `FAILED_EXECUTE_UDF` instead of appearing to succeed.
+#[test]
+fn panicking_name_fails_registration_as_failed_execute_udf() {
+    use krishiv_common::error::ErrorClass;
+    #[derive(Debug)]
+    struct PanicName;
+
+    impl ScalarUdf for PanicName {
+        fn name(&self) -> &str {
+            panic!("boom")
+        }
+
+        fn version(&self) -> u32 {
+            1
+        }
+
+        fn signature(&self) -> &Signature {
+            use std::sync::OnceLock;
+            static SIG: OnceLock<Signature> = OnceLock::new();
+            SIG.get_or_init(|| Signature::Exact(Vec::new()))
+        }
+
+        fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+            Ok(ReturnField {
+                data_type: DataType::Integer,
+                nullable: true,
+            })
+        }
+
+        fn invoke(
+            &self,
+            _: &[UdfArg<'_>],
+            rows: usize,
+            _: &InvokeContext,
+        ) -> Result<ArrayRef, UdfError> {
+            Ok(Arc::new(Int32Array::from(vec![1; rows])))
+        }
+    }
+
+    let s = Session::new().unwrap();
+    let err = s.register_udf(PanicName).unwrap_err();
+    assert_eq!(err.error_class(), ErrorClass::FailedExecuteUdf);
+    assert_eq!(err.sql_state(), Some("39000"));
+    assert!(err.to_string().contains("boom"), "{err}");
+}
+
+/// A UDF whose trait methods panic or fail: analysis fails with
+/// `FAILED_EXECUTE_UDF` naming the panic, never unwinding.
+macro_rules! panic_udf {
+    ($name:ident, $udf_name:expr, $method:ident, $panic:expr) => {
+        #[derive(Debug)]
+        struct $name;
+        impl ScalarUdf for $name {
+            fn name(&self) -> &str {
+                if stringify!($method) == "name" {
+                    panic!($panic)
+                } else {
+                    $udf_name
+                }
+            }
+            fn version(&self) -> u32 {
+                if stringify!($method) == "version" {
+                    panic!($panic)
+                } else {
+                    1
+                }
+            }
+            fn signature(&self) -> &Signature {
+                if stringify!($method) == "signature" {
+                    panic!($panic)
+                } else {
+                    use std::sync::OnceLock;
+                    static SIG: OnceLock<Signature> = OnceLock::new();
+                    SIG.get_or_init(int_sig)
+                }
+            }
+            fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+                if stringify!($method) == "return_field" {
+                    return Err(UdfError::new($panic));
+                }
+                Ok(ReturnField {
+                    data_type: DataType::Integer,
+                    nullable: true,
+                })
+            }
+            fn properties(&self) -> UdfProperties {
+                if stringify!($method) == "properties" {
+                    panic!($panic)
+                }
+                UdfProperties::default()
+            }
+            fn invoke(
+                &self,
+                args: &[UdfArg<'_>],
+                _rows: usize,
+                _: &InvokeContext,
+            ) -> Result<ArrayRef, UdfError> {
+                Ok(args[0].array())
+            }
+        }
+    };
+}
+
+panic_udf!(
+    PanicVersionUdf,
+    "panic_version_udf",
+    version,
+    "version went bang"
+);
+panic_udf!(
+    PanicSigUdf,
+    "panic_sig_udf",
+    signature,
+    "signature went bang"
+);
+panic_udf!(
+    PanicPropsUdf,
+    "panic_props_udf",
+    properties,
+    "properties went bang"
+);
+
+#[test]
+fn panicking_version_signature_properties_fail_at_analysis() {
+    let s = Session::new().unwrap();
+    s.register_udf(PanicVersionUdf).unwrap();
+    s.register_udf(PanicSigUdf).unwrap();
+    s.register_udf(PanicPropsUdf).unwrap();
+    for (query, needle) in [
+        ("SELECT panic_version_udf(1)", "version went bang"),
+        ("SELECT panic_sig_udf(1)", "signature went bang"),
+        ("SELECT panic_props_udf(1)", "properties went bang"),
+    ] {
+        let e = block_on(s.sql(query)).unwrap_err();
+        assert_eq!(e.error_class(), ErrorClass::FailedExecuteUdf, "{query}");
+        assert_eq!(e.sql_state(), Some("39000"), "{query}");
+        assert!(e.to_string().contains(needle), "{query}: {e}");
+    }
+    // DataFrame API fails the same way.
+    let schema = Arc::new(Schema::new(vec![Field::new("a", ArrowType::Int32, false)]));
+    let batch = RecordBatch::try_new(
+        Arc::clone(&schema),
+        vec![Arc::new(Int32Array::from(vec![1]))],
+    )
+    .unwrap();
+    s.register_batches("pv", schema, vec![batch]).unwrap();
+    let df = s
+        .table("pv")
+        .select([call_function("panic_version_udf", [col("a")])]);
+    let e = block_on(df.collect()).unwrap_err();
+    assert_eq!(e.error_class(), ErrorClass::FailedExecuteUdf);
+}
+
+#[test]
+fn failing_return_field_fails_at_analysis() {
+    #[derive(Debug)]
+    struct FailingReturn;
+    impl ScalarUdf for FailingReturn {
+        fn name(&self) -> &str {
+            "failing_return_udf"
+        }
+        fn version(&self) -> u32 {
+            1
+        }
+        fn signature(&self) -> &Signature {
+            use std::sync::OnceLock;
+            static SIG: OnceLock<Signature> = OnceLock::new();
+            SIG.get_or_init(int_sig)
+        }
+        fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+            Err(UdfError::new("no result for these args"))
+        }
+        fn invoke(
+            &self,
+            args: &[UdfArg<'_>],
+            _: usize,
+            _: &InvokeContext,
+        ) -> Result<ArrayRef, UdfError> {
+            Ok(args[0].array())
+        }
+    }
+    let s = Session::new().unwrap();
+    s.register_udf(FailingReturn).unwrap();
+    let e = block_on(s.sql("SELECT failing_return_udf(1)")).unwrap_err();
+    assert_eq!(e.error_class(), ErrorClass::FailedExecuteUdf);
+    assert!(e.to_string().contains("no result"), "{e}");
+}
+
+#[test]
+fn empty_names_fail_registration_as_unknown() {
+    #[derive(Debug)]
+    struct EmptyName;
+    impl ScalarUdf for EmptyName {
+        fn name(&self) -> &str {
+            ""
+        }
+        fn version(&self) -> u32 {
+            1
+        }
+        fn signature(&self) -> &Signature {
+            use std::sync::OnceLock;
+            static SIG: OnceLock<Signature> = OnceLock::new();
+            SIG.get_or_init(|| Signature::Exact(Vec::new()))
+        }
+        fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+            Ok(ReturnField {
+                data_type: DataType::Integer,
+                nullable: true,
+            })
+        }
+        fn invoke(
+            &self,
+            _: &[UdfArg<'_>],
+            rows: usize,
+            _: &InvokeContext,
+        ) -> Result<ArrayRef, UdfError> {
+            Ok(Arc::new(Int32Array::from(vec![1; rows])))
+        }
+    }
+    #[derive(Debug)]
+    struct DottedName;
+    impl ScalarUdf for DottedName {
+        fn name(&self) -> &str {
+            "a.b"
+        }
+        fn version(&self) -> u32 {
+            1
+        }
+        fn signature(&self) -> &Signature {
+            use std::sync::OnceLock;
+            static SIG: OnceLock<Signature> = OnceLock::new();
+            SIG.get_or_init(|| Signature::Exact(Vec::new()))
+        }
+        fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+            Ok(ReturnField {
+                data_type: DataType::Integer,
+                nullable: true,
+            })
+        }
+        fn invoke(
+            &self,
+            _: &[UdfArg<'_>],
+            rows: usize,
+            _: &InvokeContext,
+        ) -> Result<ArrayRef, UdfError> {
+            Ok(Arc::new(Int32Array::from(vec![1; rows])))
+        }
+    }
+    let s = Session::new().unwrap();
+    let err = s.register_udf(EmptyName).unwrap_err();
+    assert_eq!(err.error_class(), ErrorClass::FailedExecuteUdf);
+    assert!(err.to_string().contains("unknown"), "{err}");
+    let err = s.register_udf(DottedName).unwrap_err();
+    assert_eq!(err.error_class(), ErrorClass::FailedExecuteUdf);
+    assert!(err.to_string().contains("a.b"), "{err}");
+}
+
+#[test]
+fn explain_verbose_folds_udfs_through_the_traced_path() {
+    let s = Session::new().unwrap();
+    s.register_udf(AddOne).unwrap();
+    // EXPLAIN VERBOSE exercises `optimize_traced_with_udfs`.
+    let plan = explain(&s, "SELECT add_one(1)");
+    assert!(plan.contains("2") || plan.contains("add_one"), "{plan}");
+    let verbose = {
+        let df = block_on(s.sql("EXPLAIN VERBOSE SELECT add_one(1)")).unwrap();
+        let rows = block_on(df.collect()).unwrap();
+        let mut out = String::new();
+        for b in &rows {
+            for c in b.columns() {
+                if let Some(view) = c.as_any().downcast_ref::<StringViewArray>() {
+                    for v in view.iter().flatten() {
+                        out.push_str(v);
+                        out.push('\n');
+                    }
+                }
+                if let Some(plain) = c.as_any().downcast_ref::<StringArray>() {
+                    for v in plain.iter().flatten() {
+                        out.push_str(v);
+                        out.push('\n');
+                    }
+                }
+            }
+        }
+        out
+    };
+    assert!(!verbose.is_empty(), "verbose plan explains");
+}
+
+#[test]
+fn session_qualified_named_arguments_are_rejected() {
+    let s = Session::new().unwrap();
+    s.register_udf(AddOne).unwrap();
+    for query in [
+        "SELECT session.add_one(x => 1)",
+        "SELECT system.session.add_one(x => 1)",
+    ] {
+        let e = block_on(s.sql(query)).unwrap_err();
+        assert_eq!(
+            e.error_class(),
+            ErrorClass::NamedParametersNotSupported,
+            "{query}"
+        );
+    }
+}
+
+#[test]
+fn session_qualified_unknown_is_unresolved_routine() {
+    let s = Session::new().unwrap();
+    for query in [
+        "SELECT session.nosuchfn(1)",
+        "SELECT system.session.nosuchfn(1)",
+    ] {
+        let e = block_on(s.sql(query)).unwrap_err();
+        assert_eq!(e.error_class(), ErrorClass::UnresolvedRoutine, "{query}");
+        assert!(e.to_string().contains("nosuchfn"), "{query}: {e}");
+    }
+    // `system.builtin` of a UDF-only name is unknown too (on a session
+    // without the UDF, as in `builtins_win_over_a_same_name_udf`).
+    let s2 = Session::new().unwrap();
+    let e = block_on(s2.sql("SELECT system.builtin.add_one(1)")).unwrap_err();
+    assert_eq!(e.error_class(), ErrorClass::UnresolvedRoutine);
+}
+
+/// A session UDF named like the multi-argument built-in `mask`.
+#[derive(Debug)]
+struct MaskUdf;
+impl ScalarUdf for MaskUdf {
+    fn name(&self) -> &str {
+        "mask"
+    }
+    fn version(&self) -> u32 {
+        1
+    }
+    fn signature(&self) -> &Signature {
+        use std::sync::OnceLock;
+        static SIG: OnceLock<Signature> = OnceLock::new();
+        SIG.get_or_init(|| Signature::Exact(vec![UdfInputType::Exact(DataType::String)]))
+    }
+    fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+        Ok(ReturnField {
+            data_type: DataType::String,
+            nullable: true,
+        })
+    }
+    fn invoke(
+        &self,
+        args: &[UdfArg<'_>],
+        rows: usize,
+        _: &InvokeContext,
+    ) -> Result<ArrayRef, UdfError> {
+        let input = args[0].array();
+        let text = |a: &ArrayRef| -> Vec<Option<String>> {
+            if let Some(view) = a.as_any().downcast_ref::<StringViewArray>() {
+                return view.iter().map(|v| v.map(str::to_owned)).collect();
+            }
+            a.as_any()
+                .downcast_ref::<StringArray>()
+                .map(|p| p.iter().map(|v| v.map(str::to_owned)).collect())
+                .unwrap_or_else(|| vec![None; rows])
+        };
+        let col = text(&input);
+        let out: Vec<Option<String>> = (0..rows)
+            .map(|i| {
+                let at = if col.len() == 1 { 0 } else { i };
+                col.get(at)
+                    .cloned()
+                    .flatten()
+                    .map(|v| format!("udf-mask:{v}"))
+            })
+            .collect();
+        Ok(Arc::new(StringArray::from(out)))
+    }
+}
+
+#[test]
+fn mask_builtin_keeps_defaults_while_qualified_runs_the_udf() {
+    let s = Session::new().unwrap();
+    s.register_udf(MaskUdf).unwrap();
+    // Built-in `mask` with explicit replacements runs.
+    let rows = collect(&s, "SELECT mask('Ab1', 'X', 'x', 'n', NULL)");
+    assert_eq!(rows.iter().map(RecordBatch::num_rows).sum::<usize>(), 1);
+    // Built-in `mask` fills omitted replacements with its defaults.
+    let rows = collect(&s, "SELECT mask('Ab1', 'Q')");
+    assert_eq!(rows.iter().map(RecordBatch::num_rows).sum::<usize>(), 1);
+    // Qualified reaches the UDF verbatim.
+    assert_eq!(
+        one_string(&s, "SELECT session.mask('abcd')"),
+        "udf-mask:abcd"
+    );
+    assert_eq!(
+        one_string(&s, "SELECT system.session.mask('abcd')"),
+        "udf-mask:abcd"
+    );
+}
+
+/// A session UDF named like `locate` (two-arg builtin with a default).
+#[derive(Debug)]
+struct LocateUdf;
+impl ScalarUdf for LocateUdf {
+    fn name(&self) -> &str {
+        "locate"
+    }
+    fn version(&self) -> u32 {
+        1
+    }
+    fn signature(&self) -> &Signature {
+        use std::sync::OnceLock;
+        static SIG: OnceLock<Signature> = OnceLock::new();
+        SIG.get_or_init(|| {
+            Signature::Exact(vec![
+                UdfInputType::Exact(DataType::String),
+                UdfInputType::Exact(DataType::String),
+            ])
+        })
+    }
+    fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+        Ok(ReturnField {
+            data_type: DataType::Integer,
+            nullable: true,
+        })
+    }
+    fn invoke(
+        &self,
+        _: &[UdfArg<'_>],
+        rows: usize,
+        _: &InvokeContext,
+    ) -> Result<ArrayRef, UdfError> {
+        Ok(Arc::new(Int32Array::from(vec![99; rows])))
+    }
+}
+
+#[test]
+fn locate_builtin_defaults_and_qualified_udf() {
+    let s = Session::new().unwrap();
+    s.register_udf(LocateUdf).unwrap();
+    // Built-in default: `locate('b', 'abc')` finds position 2.
+    let rows = collect(&s, "SELECT locate('b', 'abc')");
+    assert_eq!(ints(&rows), [Some(2)]);
+    assert_eq!(
+        ints(&collect(&s, "SELECT session.locate('b', 'abc')")),
+        [Some(99)]
+    );
+}
+
+#[test]
+fn named_struct_folds_foldable_names() {
+    let s = Session::new().unwrap();
+    // `'a' || 'b'` folds to `'ab'`, which becomes the field name.
+    let rows = collect(&s, "SELECT named_struct('a' || 'b', 1)");
+    assert_eq!(rows.iter().map(RecordBatch::num_rows).sum::<usize>(), 1);
+}
+
+#[test]
+fn udf_calls_of_all_scalar_types_fold() {
+    // Each scalar literal type folds through the UDF binding.
+    let s = Session::new().unwrap();
+    s.register_udf(EchoString).unwrap();
+    assert_eq!(one_string(&s, "SELECT echo_str('x')"), "x");
+    let s2 = Session::new().unwrap();
+    #[derive(Debug)]
+    struct BoolEcho;
+    impl ScalarUdf for BoolEcho {
+        fn name(&self) -> &str {
+            "bool_echo"
+        }
+        fn version(&self) -> u32 {
+            1
+        }
+        fn signature(&self) -> &Signature {
+            use std::sync::OnceLock;
+            static SIG: OnceLock<Signature> = OnceLock::new();
+            SIG.get_or_init(|| Signature::Exact(vec![UdfInputType::Exact(DataType::Boolean)]))
+        }
+        fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+            Ok(ReturnField {
+                data_type: DataType::Boolean,
+                nullable: true,
+            })
+        }
+        fn invoke(
+            &self,
+            args: &[UdfArg<'_>],
+            rows: usize,
+            _: &InvokeContext,
+        ) -> Result<ArrayRef, UdfError> {
+            use arrow_array::BooleanArray;
+            let input = args[0]
+                .array()
+                .as_any()
+                .downcast_ref::<BooleanArray>()
+                .ok_or_else(|| UdfError::new("needs BOOL"))?
+                .clone();
+            assert_eq!(
+                input.len(),
+                if matches!(args[0], UdfArg::Scalar(_)) {
+                    1
+                } else {
+                    rows
+                }
+            );
+            Ok(Arc::new(input))
+        }
+    }
+    s2.register_udf(BoolEcho).unwrap();
+    let plan = explain(&s2, "SELECT bool_echo(true)");
+    assert!(plan.contains("true AS"), "{plan}");
+    // A null literal folds to null without invoking.
+    let s3 = Session::new().unwrap();
+    s3.register_udf(AddOne).unwrap();
+    let rows = collect(&s3, "SELECT add_one(CAST(NULL AS INT))");
+    assert_eq!(ints(&rows), [None]);
+}
+
+#[test]
+fn nondeterministic_distinct_filtered_and_column_calls_do_not_fold() {
+    let s = Session::new().unwrap();
+    let calls = Arc::new(AtomicUsize::new(0));
+    s.register_udf(CountingEcho {
+        deterministic: false,
+        calls: Arc::clone(&calls),
+    })
+    .unwrap();
+    // Nondeterministic already covered; distinct/filter also stay.
+    for query in [
+        "SELECT nondet_echo(DISTINCT 'a')",
+        "SELECT nondet_echo('a') FILTER (WHERE true)",
+    ] {
+        let plan = explain(&s, query);
+        assert!(plan.contains("nondet_echo"), "{query}: {plan}");
+    }
+}
+
+#[test]
+fn inline_values_reject_nondeterministic_calls() {
+    use krishiv_common::error::ErrorClass;
+    let s = Session::new().unwrap();
+    s.register_udf(AddOne).unwrap();
+    s.register_udf(CountingEcho {
+        deterministic: false,
+        calls: Arc::new(AtomicUsize::new(0)),
+    })
+    .unwrap();
+    // Deterministic UDFs are allowed in inline tables.
+    let df = block_on(s.sql("SELECT * FROM (VALUES (add_one(1)))")).unwrap();
+    let rows = block_on(df.collect()).unwrap();
+    assert_eq!(rows.iter().map(RecordBatch::num_rows).sum::<usize>(), 1);
+    // Session-qualified deterministic UDFs too.
+    let df = block_on(s.sql("SELECT * FROM (VALUES (session.add_one(1)))")).unwrap();
+    let rows = block_on(df.collect()).unwrap();
+    assert_eq!(rows.iter().map(RecordBatch::num_rows).sum::<usize>(), 1);
+    // Nondeterministic UDFs cannot be evaluated in an inline table.
+    for query in [
+        "SELECT * FROM (VALUES (nondet_echo('a')))",
+        "SELECT * FROM (VALUES (session.nondet_echo('a')))",
+        "SELECT * FROM (VALUES (rand(1)))",
+    ] {
+        let e = block_on(s.sql(query)).unwrap_err();
+        assert!(
+            e.error_class() == ErrorClass::InvalidInlineTableCannotEvaluateExpressionInInlineTable
+                || e.to_string().contains("inline"),
+            "{query}: {e}"
+        );
+    }
+}
+
+#[test]
+fn udf_results_with_views_run() {
+    // A STRING UDF returns plain Utf8; the evaluator converts to views.
+    let s = session();
+    s.register_udf(EchoString).unwrap();
+    let rows = collect(&s, "SELECT echo_str(name) FROM people ORDER BY name");
+    let mut got = strings(&rows);
+    got.sort();
+    assert_eq!(got, [None, Some("b".to_owned()), Some("c".to_owned())]);
+}
diff --git a/crates/krishiv-sql/src/lower.rs b/crates/krishiv-sql/src/lower.rs
index bcd396490..909624222 100644
--- a/crates/krishiv-sql/src/lower.rs
+++ b/crates/krishiv-sql/src/lower.rs
@@ -1690,7 +1690,7 @@ fn takes_null_treatment(name: &str) -> bool {
 fn is_predicate(e: &IrExpr) -> bool {
     match &e.node {
         ExprNode::Function(f) => matches!(
-            Builtin::from_name(&f.name),
+            f.unqualified().and_then(Builtin::from_name),
             Some(
                 Builtin::Eq
                     | Builtin::EqNullSafe
diff --git a/crates/krishiv-udf-sdk/Cargo.toml b/crates/krishiv-udf-sdk/Cargo.toml
index 3be96b5e2..6aca48249 100644
--- a/crates/krishiv-udf-sdk/Cargo.toml
+++ b/crates/krishiv-udf-sdk/Cargo.toml
@@ -8,5 +8,9 @@ license.workspace = true
 repository.workspace = true
 publish = false
 
+[dependencies]
+arrow-array.workspace = true
+krishiv-types = { path = "../krishiv-types" }
+
 [lints]
 workspace = true
diff --git a/crates/krishiv-udf-sdk/src/lib.rs b/crates/krishiv-udf-sdk/src/lib.rs
index 8e73c4ef2..e73fdad87 100644
--- a/crates/krishiv-udf-sdk/src/lib.rs
+++ b/crates/krishiv-udf-sdk/src/lib.rs
@@ -1,4 +1,80 @@
 // SPDX-License-Identifier: Apache-2.0
-//! UDF SDK (layer SDK; empty skeleton).
+//! Native Rust scalar UDFs (layer SDK).
+//!
+//! A scalar UDF is a [`ScalarUdf`] implementation registered on a session
+//! (`Session::register_udf` in `krishiv-session`): SQL
+//! and DataFrame calls of its name resolve to it, the analyzer inserts the
+//! implicit casts its [`Signature`] asks for, and the executor invokes it
+//! once per batch. Aggregate UDFs do not exist yet.
+//!
+//! The boundary is plain data: a UDF sees Arrow arrays and an
+//! [`InvokeContext`] of plain values (partition index, ANSI flag, session
+//! time zone). It never sees a session or catalog handle, never loads code,
+//! and never casts its own arguments (the analyzer already did). Plans
+//! reference a UDF by [`name`](ScalarUdf::name) and
+//! [`version`](ScalarUdf::version) only, so a plan stays pure data that any
+//! worker holding the same registration can run.
+//!
+//! ```
+//! use std::sync::Arc;
+//!
+//! use arrow_array::{ArrayRef, Int32Array};
+//! use krishiv_types::DataType;
+//! use krishiv_udf_sdk::{
+//!     ArgField, InvokeContext, ReturnField, ScalarUdf, Signature, UdfArg, UdfError,
+//!     UdfInputType,
+//! };
+//!
+//! #[derive(Debug)]
+//! struct Negate;
+//!
+//! impl ScalarUdf for Negate {
+//!     fn name(&self) -> &str {
+//!         "negate_i32"
+//!     }
+//!
+//!     fn version(&self) -> u32 {
+//!         1
+//!     }
+//!
+//!     fn signature(&self) -> &Signature {
+//!         use std::sync::OnceLock;
+//!         static SIG: OnceLock<Signature> = OnceLock::new();
+//!         SIG.get_or_init(|| Signature::Exact(vec![UdfInputType::Exact(DataType::Integer)]))
+//!     }
+//!
+//!     fn return_field(&self, args: &[ArgField]) -> Result<ReturnField, UdfError> {
+//!         let _ = args;
+//!         Ok(ReturnField {
+//!             data_type: DataType::Integer,
+//!             nullable: true,
+//!         })
+//!     }
+//!
+//!     fn invoke(
+//!         &self,
+//!         args: &[UdfArg<'_>],
+//!         rows: usize,
+//!         ctx: &InvokeContext,
+//!     ) -> Result<ArrayRef, UdfError> {
+//!         let _ = (rows, ctx);
+//!         let input = args[0].array();
+//!         let input = input
+//!             .as_any()
+//!             .downcast_ref::<Int32Array>()
+//!             .ok_or_else(|| UdfError::new("negate_i32 needs an INT argument"))?;
+//!         Ok(Arc::new(input.iter().map(|v| v.map(|v| v.wrapping_neg())).collect::<Int32Array>()))
+//!     }
+//! }
+//! ```
 
-#![deny(unsafe_op_in_unsafe_fn)]
+#![forbid(unsafe_code)]
+
+mod library;
+mod udf;
+
+pub use library::UdfLibrary;
+pub use udf::{
+    ArgField, InvokeContext, NullHandling, ReturnField, ScalarUdf, Signature, UdfArg, UdfError,
+    UdfInputType, UdfProperties, guard_call,
+};
diff --git a/crates/krishiv-udf-sdk/src/library.rs b/crates/krishiv-udf-sdk/src/library.rs
new file mode 100644
index 000000000..49a18faac
--- /dev/null
+++ b/crates/krishiv-udf-sdk/src/library.rs
@@ -0,0 +1,424 @@
+// SPDX-License-Identifier: Apache-2.0
+//! The session's UDF registrations: which implementations a name resolves
+//! to on the executing side.
+//!
+//! A [`UdfLibrary`] lives with the session that registers into it and is
+//! passed to the workers that run its plans (`WorkerContext::with_udfs` in
+//! `krishiv-exec`). Plans reference a UDF by name and version only, so
+//! the library is consulted at execution, never at planning: a worker
+//! holding another version (or none) refuses the plan with
+//! `KRISHIV_UDF_NOT_AVAILABLE` instead of running the wrong code.
+
+use std::collections::HashMap;
+use std::fmt;
+use std::sync::{Arc, PoisonError, RwLock};
+
+use super::{ScalarUdf, guard_call};
+
+/// The UDFs registered on one session, by lower-case name.
+///
+/// Re-registering a name replaces its implementation. Every registration
+/// bumps the library [`version`](Self::version): the analyzer's context
+/// fingerprint covers it, so a cached plan never outlives the registration
+/// it was analyzed with.
+pub struct UdfLibrary {
+    inner: RwLock<Inner>,
+}
+
+#[derive(Debug, Default)]
+struct Inner {
+    udfs: HashMap<String, Arc<dyn ScalarUdf>>,
+    /// Bumped on every registration; part of the analysis fingerprint.
+    epoch: u64,
+}
+
+impl UdfLibrary {
+    /// An empty library.
+    #[must_use]
+    pub fn new() -> Self {
+        Self {
+            inner: RwLock::new(Inner::default()),
+        }
+    }
+
+    /// Registers `udf` under its lower-case [`name`](ScalarUdf::name),
+    /// replacing any UDF of that name, and bumps the library version.
+    ///
+    /// The `name` call goes through [`guard_call`] like every other trait
+    /// call: a panicking `name` is returned as a [`UdfError`](crate::UdfError) instead of
+    /// unwinding (there is no name to register the UDF under). An empty
+    /// name, or one containing a `.` or a backtick, is also an error,
+    /// since such a UDF can never be called by name.
+    ///
+    /// # Errors
+    /// A [`UdfError`](crate::UdfError) when `name` panics, is empty, or contains a `.` or
+    /// a backtick.
+    pub fn register(&self, udf: Arc<dyn ScalarUdf>) -> Result<(), super::UdfError> {
+        let name = guard_call("unknown", "name", || udf.name().to_owned())?;
+        if name.is_empty() {
+            return Err(super::UdfError::new(
+                "UDF name is empty: a UDF name must be non-empty and contain no '.' or '`', so the UDF could never be called by name",
+            ));
+        }
+        if name.contains('.') || name.contains('`') {
+            return Err(super::UdfError::new(format!(
+                "UDF {name}.name is invalid: a UDF name must contain no '.' or '`', so the UDF could never be called by name"
+            )));
+        }
+        let name = name.to_lowercase();
+        let mut inner = self.inner.write().unwrap_or_else(PoisonError::into_inner);
+        inner.udfs.insert(name, udf);
+        inner.epoch = inner.epoch.wrapping_add(1);
+        Ok(())
+    }
+
+    /// The UDF named `name` (case-insensitive), if registered.
+    #[must_use]
+    pub fn get(&self, name: &str) -> Option<Arc<dyn ScalarUdf>> {
+        let inner = self.inner.read().unwrap_or_else(PoisonError::into_inner);
+        inner.udfs.get(&name.to_lowercase()).cloned()
+    }
+
+    /// The UDF named `name` at `version` (both case- and
+    /// version-sensitive), as a plan references it; `None` when the name is
+    /// unregistered or holds another version. A panicking `version` matches
+    /// (through [`guard_call`]) so that binding surfaces `FAILED_EXECUTE_UDF`
+    /// rather than `KRISHIV_UDF_NOT_AVAILABLE`.
+    #[must_use]
+    pub fn get_versioned(&self, name: &str, version: u32) -> Option<Arc<dyn ScalarUdf>> {
+        let udf = self.get(name)?;
+        let matches = match guard_call(name, "version", || udf.version()) {
+            Ok(v) => v == version,
+            Err(_) => true,
+        };
+        matches.then_some(udf)
+    }
+
+    /// Bumped on every registration; part of the analysis fingerprint.
+    #[must_use]
+    pub fn version(&self) -> u64 {
+        self.inner
+            .read()
+            .unwrap_or_else(PoisonError::into_inner)
+            .epoch
+    }
+
+    /// Whether no UDF is registered.
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.inner
+            .read()
+            .unwrap_or_else(PoisonError::into_inner)
+            .udfs
+            .is_empty()
+    }
+}
+
+impl Default for UdfLibrary {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl fmt::Debug for UdfLibrary {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let inner = self.inner.read().unwrap_or_else(PoisonError::into_inner);
+        let mut names: Vec<String> = inner
+            .udfs
+            .values()
+            .map(|u| {
+                let name = guard_call("unknown", "name", || u.name().to_owned())
+                    .unwrap_or_else(|_| "<panicking>".to_owned());
+                let version = guard_call(&name, "version", || u.version())
+                    .map(|v| v.to_string())
+                    .unwrap_or_else(|_| "<panicking>".to_owned());
+                format!("{name}@{version}")
+            })
+            .collect();
+        names.sort();
+        f.debug_struct("UdfLibrary")
+            .field("udfs", &names)
+            .field("epoch", &inner.epoch)
+            .finish()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::super::{ArgField, InvokeContext, ReturnField, Signature, UdfArg, UdfError};
+    use super::*;
+
+    use arrow_array::ArrayRef;
+    use krishiv_types::DataType;
+
+    #[derive(Debug)]
+    struct Identity {
+        version: u32,
+    }
+
+    impl ScalarUdf for Identity {
+        fn name(&self) -> &str {
+            "my_identity"
+        }
+
+        fn version(&self) -> u32 {
+            self.version
+        }
+
+        fn signature(&self) -> &Signature {
+            use std::sync::OnceLock;
+            static SIG: OnceLock<Signature> = OnceLock::new();
+            SIG.get_or_init(|| Signature::Exact(Vec::new()))
+        }
+
+        fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+            Ok(ReturnField {
+                data_type: DataType::Integer,
+                nullable: true,
+            })
+        }
+
+        fn invoke(
+            &self,
+            _: &[UdfArg<'_>],
+            _: usize,
+            _: &InvokeContext,
+        ) -> Result<ArrayRef, UdfError> {
+            Err(UdfError::new("unimplemented"))
+        }
+    }
+
+    #[test]
+    fn registration_replaces_and_bumps_the_version() {
+        let lib = UdfLibrary::new();
+        assert!(lib.is_empty());
+        assert_eq!(lib.version(), 0);
+        lib.register(Arc::new(Identity { version: 1 })).unwrap();
+        assert!(!lib.is_empty());
+        assert_eq!(lib.version(), 1);
+        assert_eq!(lib.get("MY_IDENTITY").unwrap().version(), 1);
+        // Another registration, same or new version: replaced, bumped.
+        lib.register(Arc::new(Identity { version: 2 })).unwrap();
+        assert_eq!(lib.version(), 2);
+        assert_eq!(lib.get("my_identity").unwrap().version(), 2);
+        assert!(lib.get("nosuch").is_none());
+        // A plan names its version: only the matching one resolves.
+        assert!(lib.get_versioned("my_identity", 2).is_some());
+        assert!(lib.get_versioned("my_identity", 1).is_none());
+        assert!(lib.get_versioned("nosuch", 2).is_none());
+        assert_eq!(
+            format!("{lib:?}"),
+            "UdfLibrary { udfs: [\"my_identity@2\"], epoch: 2 }"
+        );
+        assert_eq!(format!("{}", UdfLibrary::default().version()), "0");
+    }
+
+    /// A UDF whose `name` panics: registration catches it and leaves the
+    /// library unchanged instead of unwinding.
+    #[derive(Debug)]
+    struct PanicName;
+
+    impl ScalarUdf for PanicName {
+        fn name(&self) -> &str {
+            panic!("boom")
+        }
+
+        fn version(&self) -> u32 {
+            1
+        }
+
+        fn signature(&self) -> &Signature {
+            use std::sync::OnceLock;
+            static SIG: OnceLock<Signature> = OnceLock::new();
+            SIG.get_or_init(|| Signature::Exact(Vec::new()))
+        }
+
+        fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+            Ok(ReturnField {
+                data_type: DataType::Integer,
+                nullable: true,
+            })
+        }
+
+        fn invoke(
+            &self,
+            _: &[UdfArg<'_>],
+            _: usize,
+            _: &InvokeContext,
+        ) -> Result<ArrayRef, UdfError> {
+            Err(UdfError::new("test only"))
+        }
+    }
+
+    #[test]
+    fn panicking_name_leaves_the_library_unchanged() {
+        let lib = UdfLibrary::new();
+        let result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+            lib.register(Arc::new(PanicName)).unwrap_err()
+        }));
+        let err = result.expect("a UDF whose name panics must not unwind registration");
+        assert!(err.message().contains("boom"), "{err}");
+        assert!(lib.is_empty());
+        assert_eq!(lib.version(), 0);
+    }
+
+    /// A UDF with an empty, dotted or backquoted name: registration
+    /// rejects it, since such a UDF can never be called by name.
+    #[derive(Debug)]
+    struct BadName(&'static str);
+
+    impl ScalarUdf for BadName {
+        fn name(&self) -> &str {
+            self.0
+        }
+
+        fn version(&self) -> u32 {
+            1
+        }
+
+        fn signature(&self) -> &Signature {
+            use std::sync::OnceLock;
+            static SIG: OnceLock<Signature> = OnceLock::new();
+            SIG.get_or_init(|| Signature::Exact(Vec::new()))
+        }
+
+        fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+            Ok(ReturnField {
+                data_type: DataType::Integer,
+                nullable: true,
+            })
+        }
+
+        fn invoke(
+            &self,
+            _: &[UdfArg<'_>],
+            _: usize,
+            _: &InvokeContext,
+        ) -> Result<ArrayRef, UdfError> {
+            Err(UdfError::new("test only"))
+        }
+    }
+
+    #[test]
+    fn empty_dotted_or_backquoted_names_are_rejected() {
+        for bad in ["", "a.b", "a`b"] {
+            let lib = UdfLibrary::new();
+            let err = lib.register(Arc::new(BadName(bad))).unwrap_err();
+            assert!(!err.message().is_empty(), "{bad}: {err}");
+            assert!(lib.is_empty(), "{bad}");
+            assert_eq!(lib.version(), 0, "{bad}");
+        }
+    }
+
+    #[test]
+    fn fixtures_expose_their_declared_contracts() {
+        let lib = UdfLibrary::new();
+        lib.register(Arc::new(Identity { version: 1 })).unwrap();
+        let udf = lib.get("my_identity").unwrap();
+        assert_eq!(udf.version(), 1);
+        assert_eq!(
+            udf.signature(),
+            &Signature::Exact(Vec::new()),
+            "zero-arg signature"
+        );
+        let field = udf.return_field(&[]).unwrap();
+        assert_eq!(field.data_type, krishiv_types::DataType::Integer);
+        assert!(field.nullable);
+        assert!(
+            udf.invoke(
+                &[],
+                0,
+                &InvokeContext {
+                    partition: 0,
+                    ansi: true,
+                    time_zone: None,
+                }
+            )
+            .is_err()
+        );
+        // The panicking-name and bad-name fixtures expose theirs too.
+        let panicking = PanicName;
+        assert_eq!(panicking.version(), 1);
+        assert_eq!(panicking.signature(), &Signature::Exact(Vec::new()));
+        assert!(panicking.return_field(&[]).is_ok());
+        assert!(
+            panicking
+                .invoke(
+                    &[],
+                    0,
+                    &InvokeContext {
+                        partition: 0,
+                        ansi: true,
+                        time_zone: None,
+                    }
+                )
+                .is_err()
+        );
+        for bad in ["", "a.b", "a`b"] {
+            let udf = BadName(bad);
+            assert_eq!(udf.version(), 1);
+            assert_eq!(udf.signature(), &Signature::Exact(Vec::new()));
+            assert!(udf.return_field(&[]).is_ok());
+            assert!(
+                udf.invoke(
+                    &[],
+                    0,
+                    &InvokeContext {
+                        partition: 0,
+                        ansi: true,
+                        time_zone: None,
+                    }
+                )
+                .is_err()
+            );
+        }
+    }
+
+    /// A UDF whose `version` panics still resolves by name and version: the
+    /// match defaults to true so binding surfaces `FAILED_EXECUTE_UDF`
+    /// rather than `KRISHIV_UDF_NOT_AVAILABLE`.
+    #[derive(Debug)]
+    struct PanicVersion;
+
+    impl ScalarUdf for PanicVersion {
+        fn name(&self) -> &str {
+            "panic_version"
+        }
+
+        fn version(&self) -> u32 {
+            panic!("version went bang")
+        }
+
+        fn signature(&self) -> &Signature {
+            use std::sync::OnceLock;
+            static SIG: OnceLock<Signature> = OnceLock::new();
+            SIG.get_or_init(|| Signature::Exact(Vec::new()))
+        }
+
+        fn return_field(&self, _: &[ArgField]) -> Result<ReturnField, UdfError> {
+            Ok(ReturnField {
+                data_type: krishiv_types::DataType::Integer,
+                nullable: true,
+            })
+        }
+
+        fn invoke(
+            &self,
+            _: &[UdfArg<'_>],
+            _: usize,
+            _: &InvokeContext,
+        ) -> Result<ArrayRef, UdfError> {
+            Err(UdfError::new("test only"))
+        }
+    }
+
+    #[test]
+    fn a_panicking_version_still_matches() {
+        let lib = UdfLibrary::new();
+        lib.register(Arc::new(PanicVersion)).unwrap();
+        assert!(lib.get("panic_version").is_some());
+        assert!(lib.get_versioned("panic_version", 1).is_some());
+        assert!(lib.get_versioned("panic_version", 999).is_some());
+        assert!(lib.get_versioned("nosuch", 1).is_none());
+    }
+}
diff --git a/crates/krishiv-udf-sdk/src/udf.rs b/crates/krishiv-udf-sdk/src/udf.rs
new file mode 100644
index 000000000..4ef43b175
--- /dev/null
+++ b/crates/krishiv-udf-sdk/src/udf.rs
@@ -0,0 +1,476 @@
+// SPDX-License-Identifier: Apache-2.0
+//! The UDF boundary types: what a UDF declares ([`Signature`],
+//! [`UdfProperties`]), what it computes over ([`UdfArg`],
+//! [`InvokeContext`]), and what it reports ([`UdfError`]).
+//!
+//! Every type here is plain data over Arrow arrays and
+//! [`krishiv_types::DataType`], so it crosses threads and processes without
+//! handles. The analyzer maps a [`Signature`] onto its own arity and input
+//! types (so implicit casts come from the existing coercion, never from the
+//! UDF), and the executor checks the result the UDF returns against what
+//! [`ScalarUdf::return_field`] declared.
+
+use std::fmt;
+use std::sync::Arc;
+
+use arrow_array::ArrayRef;
+use krishiv_types::DataType;
+
+/// How a UDF takes its arguments: one variant per arity shape, over the
+/// same input-type forms the built-in registry uses (see
+/// `krishiv_functions::signature::InputType`, which these mirror so this
+/// layer-1 crate stays free of layer-2 types).
+#[derive(Debug, Clone, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum Signature {
+    /// Exactly one argument per entry, in order, each implicitly cast to
+    /// its declared type where the analyzer's coercion allows (as a
+    /// built-in with the same declared inputs).
+    Exact(Vec<UdfInputType>),
+    /// `min_arity` or more arguments, each implicitly cast to `element`
+    /// (the last declared type repeats for further arguments, as with
+    /// built-ins).
+    Variadic {
+        /// The type every argument takes.
+        element: UdfInputType,
+        /// The fewest arguments the call takes.
+        min_arity: usize,
+    },
+    /// Exactly one argument per entry, in order, with no implicit casts:
+    /// each argument must already have its declared type (an untyped `NULL`
+    /// still becomes it), else the call fails with
+    /// `DATATYPE_MISMATCH.UNEXPECTED_INPUT_TYPE` as a built-in's does.
+    Coercible(Vec<UdfInputType>),
+}
+
+/// The type an argument must have: what the analyzer casts to (or checks,
+/// for [`Signature::Coercible`]). Mirrors
+/// `krishiv_functions::signature::InputType` entry for entry; the session
+/// layer maps each form onto it.
+#[derive(Debug, Clone, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum UdfInputType {
+    /// Any type, as it is.
+    Any,
+    /// Exactly this type (implicitly cast where the analyzer allows).
+    Exact(DataType),
+    /// This type and no other: an untyped `NULL` becomes it, any other
+    /// type is `DATATYPE_MISMATCH.UNEXPECTED_INPUT_TYPE`.
+    Strict(DataType),
+    /// Any numeric type; a string or untyped `NULL` becomes `DOUBLE`.
+    Numeric {
+        /// Whether the required type also names ANSI intervals.
+        intervals: bool,
+    },
+    /// One of these types: an argument of one of them stays as it is,
+    /// another is cast to the first it may be cast to implicitly.
+    OneOf(Vec<DataType>),
+}
+
+impl UdfInputType {
+    /// The required type as Spark's errors print it.
+    #[must_use]
+    pub fn sql(&self) -> String {
+        match self {
+            Self::Any => "\"ANY\"".to_owned(),
+            Self::Exact(t) | Self::Strict(t) => format!("\"{}\"", t.sql()),
+            Self::Numeric { intervals: false } => "\"NUMERIC\"".to_owned(),
+            Self::Numeric { intervals: true } => "\"NUMERIC\" or \"ANSI INTERVAL\"".to_owned(),
+            Self::OneOf(types)
+                if matches!(
+                    types.as_slice(),
+                    [DataType::Timestamp, DataType::TimestampNtz]
+                ) =>
+            {
+                "\"(TIMESTAMP OR TIMESTAMP WITHOUT TIME ZONE)\"".to_owned()
+            }
+            Self::OneOf(types) => {
+                let names: Vec<String> = types.iter().map(|t| format!("\"{}\"", t.sql())).collect();
+                format!("({})", names.join(" or "))
+            }
+        }
+    }
+}
+
+impl Signature {
+    /// Whether `n` arguments pass the arity check.
+    #[must_use]
+    pub fn accepts(&self, n: usize) -> bool {
+        match self {
+            Self::Exact(types) | Self::Coercible(types) => n == types.len(),
+            Self::Variadic { min_arity, .. } => n >= *min_arity,
+        }
+    }
+
+    /// Spark's `expectedNum` text for `WRONG_NUM_ARGS` (`"1"`, `"> 0"`).
+    #[must_use]
+    pub fn arity_text(&self) -> String {
+        match self {
+            Self::Exact(types) | Self::Coercible(types) => types.len().to_string(),
+            Self::Variadic { min_arity, .. } => {
+                if *min_arity == 0 {
+                    String::new()
+                } else {
+                    format!("> {}", min_arity.saturating_sub(1))
+                }
+            }
+        }
+    }
+
+    /// The declared input types as Spark's errors print them (`"INT,
+    /// \"STRING\""`; a variadic tail prints as `"..."`).
+    #[must_use]
+    pub fn inputs_sql(&self) -> String {
+        match self {
+            Self::Exact(types) | Self::Coercible(types) => types
+                .iter()
+                .map(UdfInputType::sql)
+                .collect::<Vec<_>>()
+                .join(", "),
+            Self::Variadic { element, .. } => format!("{}, ...", element.sql()),
+        }
+    }
+}
+
+/// An argument as [`ScalarUdf::return_field`] sees it: its type after the
+/// analyzer's implicit casts (`None` for an untyped `NULL`) and whether it
+/// may be null. Pure: the declared result follows from these alone.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ArgField {
+    /// The type; `None` for an untyped `NULL`.
+    pub data_type: Option<DataType>,
+    /// Whether it may be null.
+    pub nullable: bool,
+}
+
+/// The declared result of a call: its type and whether it may be null.
+/// The executor checks every result against this (wrong type, length or
+/// nullability is `FAILED_EXECUTE_UDF`, never silent).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ReturnField {
+    /// The result type.
+    pub data_type: DataType,
+    /// Whether the result may be null. A UDF that declares non-nullable
+    /// results must never return a null; the executor fails the query if
+    /// it does.
+    pub nullable: bool,
+}
+
+/// How a UDF treats null inputs.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+#[non_exhaustive]
+pub enum NullHandling {
+    /// A row with a null argument is null without invoking the UDF (as
+    /// Spark's strict functions are). The UDF then never sees a null.
+    #[default]
+    Strict,
+    /// The UDF sees every row, nulls included, and decides its own nulls.
+    Custom,
+}
+
+/// What never changes about a call: determinism and null handling.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct UdfProperties {
+    /// Whether the result follows from the arguments alone. A
+    /// nondeterministic UDF is never moved, duplicated or folded; only a
+    /// deterministic one folds over literal arguments.
+    pub deterministic: bool,
+    /// How null inputs reach the UDF.
+    pub null_handling: NullHandling,
+}
+
+impl Default for UdfProperties {
+    fn default() -> Self {
+        Self {
+            deterministic: true,
+            null_handling: NullHandling::Strict,
+        }
+    }
+}
+
+/// An argument at invocation: a column of `rows` values, or a literal as a
+/// one-row array (as the built-in bindings see them). String columns may
+/// use any UTF-8 carrier (`Utf8`, `Utf8View`, `LargeUtf8`) and binary
+/// columns any binary carrier, whichever the evaluator produced; results
+/// use the plain carriers (`Utf8`, `Binary`).
+#[derive(Debug, Clone, Copy)]
+#[non_exhaustive]
+pub enum UdfArg<'a> {
+    /// A column of `rows` values.
+    Column(&'a ArrayRef),
+    /// A literal, as a one-row array.
+    Scalar(&'a ArrayRef),
+}
+
+impl UdfArg<'_> {
+    /// The values.
+    #[must_use]
+    pub fn array(self) -> ArrayRef {
+        match self {
+            Self::Column(a) | Self::Scalar(a) => Arc::clone(a),
+        }
+    }
+}
+
+/// What a UDF's result may depend on besides its arguments: plain values
+/// only, never a session or catalog handle.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct InvokeContext {
+    /// The partition the batch belongs to. The engine runs each query in
+    /// one stage without stable partition ids, so this is always zero; a
+    /// UDF that reads it must declare itself nondeterministic.
+    pub partition: u32,
+    /// `spark.sql.ansi.enabled`.
+    pub ansi: bool,
+    /// The session time zone as a fixed offset in seconds, when it is one
+    /// (`UTC`, `+hh:mm`); `None` in a region zone, which the engine does
+    /// not resolve yet.
+    pub time_zone: Option<i32>,
+}
+
+/// What a UDF reports when it cannot compute its result: a plain message.
+/// The executor raises it as Spark's `FAILED_EXECUTE_UDF` (SQLSTATE 39000),
+/// naming the UDF, its signature and its result type.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct UdfError {
+    message: String,
+}
+
+impl UdfError {
+    /// An error with `message`.
+    #[must_use]
+    pub fn new(message: impl Into<String>) -> Self {
+        Self {
+            message: message.into(),
+        }
+    }
+
+    /// The message.
+    #[must_use]
+    pub fn message(&self) -> &str {
+        &self.message
+    }
+}
+
+impl fmt::Display for UdfError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(&self.message)
+    }
+}
+
+impl std::error::Error for UdfError {}
+
+impl From<String> for UdfError {
+    fn from(message: String) -> Self {
+        Self::new(message)
+    }
+}
+
+impl From<&str> for UdfError {
+    fn from(message: &str) -> Self {
+        Self::new(message)
+    }
+}
+
+/// Calls a UDF trait method, catching panics as [`UdfError`].
+///
+/// Every engine call to a UDF trait method (`signature`, `return_field`,
+/// `properties`, `invoke`, and the `name`/`version` reads in the query
+/// path) goes through this, so a panicking UDF becomes an error
+/// (eventually Spark's `FAILED_EXECUTE_UDF`) rather than unwinding the
+/// engine.
+pub fn guard_call<T>(
+    udf_name: &str,
+    method: &'static str,
+    f: impl FnOnce() -> T,
+) -> Result<T, UdfError> {
+    match std::panic::catch_unwind(std::panic::AssertUnwindSafe(f)) {
+        Ok(v) => Ok(v),
+        Err(payload) => Err(UdfError::new(format!(
+            "UDF {udf_name}.{method} panicked: {}",
+            panic_payload(&payload)
+        ))),
+    }
+}
+
+/// The panic payload as a message.
+fn panic_payload(payload: &Box<dyn std::any::Any + Send>) -> String {
+    if let Some(s) = payload.downcast_ref::<String>() {
+        s.clone()
+    } else if let Some(s) = payload.downcast_ref::<&str>() {
+        (*s).to_owned()
+    } else {
+        "a panic without a message".to_owned()
+    }
+}
+
+/// A native Rust scalar function: one row in, one value out.
+///
+/// The implementation must be pure besides what [`InvokeContext`] carries:
+/// the same arguments (and context) give the same result, unless
+/// [`properties`](Self::properties) declares otherwise. It must not retain
+/// state between invocations, and it must never panic: the engine catches
+/// panics in every trait method through [`guard_call`] and fails the query
+/// with `FAILED_EXECUTE_UDF` (but only after unwinding the worker).
+/// Results use the plain Arrow carriers (`Utf8` for `STRING`, `Binary` for
+/// `BINARY`); the engine converts strings and binaries to views itself.
+pub trait ScalarUdf: Send + Sync + fmt::Debug + 'static {
+    /// The function name, resolved case-insensitively (stored lower-case).
+    /// Built-ins win over a same-name session UDF on the bare search path.
+    /// A panic becomes `FAILED_EXECUTE_UDF` through [`guard_call`].
+    fn name(&self) -> &str;
+
+    /// The implementation version. Plans reference the UDF by name and
+    /// version, so bump it whenever the behaviour changes: a cached plan
+    /// naming an older version never runs the newer code, and a worker
+    /// holding another version refuses the plan instead of misreading it.
+    /// A panic becomes `FAILED_EXECUTE_UDF` through [`guard_call`].
+    fn version(&self) -> u32;
+
+    /// The arity and argument types (see [`Signature`]).
+    /// A panic becomes `FAILED_EXECUTE_UDF` through [`guard_call`].
+    fn signature(&self) -> &Signature;
+
+    /// The result type and nullability for arguments of these types (after
+    /// the analyzer's implicit casts). Pure: the same argument fields give
+    /// the same field, so analysis and execution always agree.
+    /// A panic becomes `FAILED_EXECUTE_UDF` through [`guard_call`].
+    ///
+    /// # Errors
+    /// A [`UdfError`] when these argument types have no result (raised as
+    /// Spark's error for the call, at analysis).
+    fn return_field(&self, args: &[ArgField]) -> Result<ReturnField, UdfError>;
+
+    /// Determinism and null handling; deterministic and [`Strict`](NullHandling::Strict)
+    /// unless overridden.
+    /// A panic becomes `FAILED_EXECUTE_UDF` through [`guard_call`].
+    fn properties(&self) -> UdfProperties {
+        UdfProperties::default()
+    }
+
+    /// The function over one batch: `args` in the bound order, each a
+    /// column of `rows` values or a one-row literal (see [`UdfArg`]). The
+    /// result has `rows` values, of the declared type; with
+    /// [`Strict`](NullHandling::Strict) handling the engine only invokes
+    /// this for rows without nulls (and returns null without invoking when
+    /// every row has one).
+    /// A panic becomes `FAILED_EXECUTE_UDF` through [`guard_call`].
+    ///
+    /// # Errors
+    /// A [`UdfError`] when the values cannot be computed (raised as
+    /// `FAILED_EXECUTE_UDF`, naming the UDF).
+    fn invoke(
+        &self,
+        args: &[UdfArg<'_>],
+        rows: usize,
+        ctx: &InvokeContext,
+    ) -> Result<ArrayRef, UdfError>;
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn input_types_print_as_spark() {
+        assert_eq!(UdfInputType::Any.sql(), r#""ANY""#);
+        assert_eq!(UdfInputType::Exact(DataType::Date).sql(), r#""DATE""#);
+        assert_eq!(UdfInputType::Strict(DataType::Integer).sql(), r#""INT""#);
+        assert_eq!(
+            UdfInputType::Numeric { intervals: false }.sql(),
+            r#""NUMERIC""#
+        );
+        assert_eq!(
+            UdfInputType::Numeric { intervals: true }.sql(),
+            r#""NUMERIC" or "ANSI INTERVAL""#
+        );
+        assert_eq!(
+            UdfInputType::OneOf(vec![DataType::String, DataType::Binary]).sql(),
+            r#"("STRING" or "BINARY")"#
+        );
+        assert_eq!(
+            UdfInputType::OneOf(vec![DataType::Timestamp, DataType::TimestampNtz]).sql(),
+            r#""(TIMESTAMP OR TIMESTAMP WITHOUT TIME ZONE)""#
+        );
+    }
+
+    #[test]
+    fn signatures_print_arity_and_inputs() {
+        assert_eq!(Signature::Exact(vec![]).arity_text(), "0");
+        assert_eq!(
+            Signature::Exact(vec![
+                UdfInputType::Exact(DataType::Integer),
+                UdfInputType::Exact(DataType::String),
+            ])
+            .arity_text(),
+            "2"
+        );
+        assert_eq!(
+            Signature::Coercible(vec![UdfInputType::Exact(DataType::Integer)]).arity_text(),
+            "1"
+        );
+        assert_eq!(
+            Signature::Variadic {
+                element: UdfInputType::Exact(DataType::String),
+                min_arity: 0,
+            }
+            .arity_text(),
+            ""
+        );
+        assert_eq!(
+            Signature::Variadic {
+                element: UdfInputType::Exact(DataType::String),
+                min_arity: 2,
+            }
+            .arity_text(),
+            "> 1"
+        );
+        assert!(Signature::Exact(vec![]).accepts(0));
+        assert!(!Signature::Exact(vec![]).accepts(1));
+        assert_eq!(Signature::Exact(vec![]).inputs_sql(), "");
+    }
+
+    #[test]
+    fn panics_become_failed_execute_udf_with_their_payload() {
+        let via_string = guard_call("f", "invoke", || -> i32 {
+            std::panic::panic_any("owned".to_owned())
+        })
+        .unwrap_err();
+        assert!(via_string.message().contains("owned"), "{via_string}");
+        let via_str = guard_call("f", "invoke", || -> i32 { panic!("borrowed") }).unwrap_err();
+        assert!(via_str.message().contains("borrowed"), "{via_str}");
+        let via_other =
+            guard_call("f", "invoke", || -> i32 { std::panic::panic_any(42_i32) }).unwrap_err();
+        assert!(
+            via_other.message().contains("without a message"),
+            "{via_other}"
+        );
+    }
+
+    #[test]
+    fn properties_default_to_deterministic_strict() {
+        let props = UdfProperties::default();
+        assert!(props.deterministic);
+        assert_eq!(props.null_handling, NullHandling::Strict);
+        assert_eq!(NullHandling::default(), NullHandling::Strict);
+    }
+
+    #[test]
+    fn udf_errors_carry_their_message() {
+        let e = UdfError::new("boom");
+        assert_eq!(e.message(), "boom");
+        assert_eq!(format!("{e}"), "boom");
+        assert_eq!(UdfError::from("x".to_owned()), UdfError::new("x"));
+        assert_eq!(UdfError::from("y"), UdfError::new("y"));
+        let _: &dyn std::error::Error = &e;
+    }
+
+    #[test]
+    fn args_borrow_their_arrays() {
+        let array: ArrayRef = Arc::new(arrow_array::Int32Array::from(vec![1]));
+        let arg = UdfArg::Column(&array);
+        assert!(Arc::ptr_eq(&arg.array(), &array));
+        let lit = UdfArg::Scalar(&array);
+        assert!(Arc::ptr_eq(&lit.array(), &array));
+    }
+}
diff --git a/crates/krishiv/public-api.txt b/crates/krishiv/public-api.txt
index 3f0cc7a5b..f4f6db654 100644
--- a/crates/krishiv/public-api.txt
+++ b/crates/krishiv/public-api.txt
@@ -1,4 +1,5 @@
 pub mod krishiv
+pub use krishiv::ArgField
 pub use krishiv::Column
 pub use krishiv::DataFrame
 pub use krishiv::DataFrameReader
@@ -9,14 +10,24 @@ pub use krishiv::ExplainMode
 pub use krishiv::ExplainVerbose
 pub use krishiv::GraphFormat
 pub use krishiv::GroupedData
+pub use krishiv::InvokeContext
 pub use krishiv::JoinType
+pub use krishiv::NullHandling
 pub use krishiv::OptimizerStep
 pub use krishiv::QueryProfile
 pub use krishiv::RecordBatchStream
+pub use krishiv::ReturnField
 pub use krishiv::RuntimeConf
+pub use krishiv::ScalarUdf
 pub use krishiv::Session
 pub use krishiv::SessionBuilder
+pub use krishiv::Signature
 pub use krishiv::TextOptions
+pub use krishiv::UdfArg
+pub use krishiv::UdfError
+pub use krishiv::UdfInputType
+pub use krishiv::UdfLibrary
+pub use krishiv::UdfProperties
 pub use krishiv::dot_of_profile
 pub use krishiv::functions
 pub use krishiv::mermaid_of_profile
diff --git a/crates/krishiv/src/lib.rs b/crates/krishiv/src/lib.rs
index d3b71579e..b197ad1e4 100644
--- a/crates/krishiv/src/lib.rs
+++ b/crates/krishiv/src/lib.rs
@@ -31,9 +31,11 @@
 
 pub use krishiv_common::error::KrishivError as Error;
 pub use krishiv_session::{
-    Column, DataFrame, DataFrameReader, DataFrameWriter, ExplainMode, ExplainVerbose, GraphFormat,
-    GroupedData, JoinType, OptimizerStep, QueryProfile, RecordBatchStream, RuntimeConf, Session,
-    SessionBuilder, TextOptions, dot_of_profile, functions, mermaid_of_profile,
+    ArgField, Column, DataFrame, DataFrameReader, DataFrameWriter, ExplainMode, ExplainVerbose,
+    GraphFormat, GroupedData, InvokeContext, JoinType, NullHandling, OptimizerStep, QueryProfile,
+    RecordBatchStream, ReturnField, RuntimeConf, ScalarUdf, Session, SessionBuilder, Signature,
+    TextOptions, UdfArg, UdfError, UdfInputType, UdfLibrary, UdfProperties, dot_of_profile,
+    functions, mermaid_of_profile,
 };
 /// Spark SQL data types, for [`Column::cast`].
 pub use krishiv_types::DataType;
diff --git a/proto/krishiv/plan/v1/plan.proto b/proto/krishiv/plan/v1/plan.proto
index 30dd37616..6d36935f3 100644
--- a/proto/krishiv/plan/v1/plan.proto
+++ b/proto/krishiv/plan/v1/plan.proto
@@ -656,10 +656,13 @@ enum FunctionKind {
 }
 
 message Function {
-  // A canonical operator name (`==`, `and`, ...), or a registry function.
+  // A canonical operator name (`==`, `and`, ...), a registry function, or
+  // a session UDF.
   oneof id {
     string builtin = 1;
     RegistryFunction registry = 2;
+    // feature: rust_udf
+    UdfFunction udf = 10;
   }
   FunctionKind kind = 3;
   repeated uint32 args = 4;
@@ -677,6 +680,14 @@ message RegistryFunction {
   uint32 id = 2;
 }
 
+// A session-registered native Rust UDF, by name and implementation
+// version. A worker must hold the same version to run the plan.
+// feature: rust_udf
+message UdfFunction {
+  string name = 1;
+  uint64 version = 2;
+}
+
 // A Spark type.
 message DataType {
   enum Kind {