diff --git a/vortex-array/src/expr/analysis/fallible.rs b/vortex-array/src/expr/analysis/fallible.rs
index ff43d51603b..1d5ad53a59f 100644
--- a/vortex-array/src/expr/analysis/fallible.rs
+++ b/vortex-array/src/expr/analysis/fallible.rs
@@ -10,8 +10,9 @@ pub fn label_is_fallible(expr: &Expression) -> BooleanLabels<'_> {
         expr,
         |expr| match expr {
             Expression::Scalar { scalar_fn, .. } => scalar_fn.signature().is_fallible(),
-            // The scope itself cannot fail.
-            Expression::Root => false,
+            Expression::HigherOrder { .. } => true,
+            Expression::Lambda(_) => true,
+            Expression::Root | Expression::Variable(_) => false,
         },
         |acc, &child| acc | child,
     )
diff --git a/vortex-array/src/expr/analysis/immediate_access.rs b/vortex-array/src/expr/analysis/immediate_access.rs
index 6c2e4975a92..bd4491af00a 100644
--- a/vortex-array/src/expr/analysis/immediate_access.rs
+++ b/vortex-array/src/expr/analysis/immediate_access.rs
@@ -67,7 +67,11 @@ pub fn make_bound_free_field_annotator(
 ) -> impl AnnotationFn<BoundExpression, Annotation = FieldName> {
     move |expr: &BoundExpression| {
         let Some(scalar_fn) = expr.as_scalar() else {
-            return scope.names().iter().cloned().collect();
+            return if expr.is_root() {
+                scope.names().iter().cloned().collect()
+            } else {
+                vec![]
+            };
         };
 
         if let Some(selection) = scalar_fn.as_opt::<Select>() {
@@ -87,3 +91,37 @@ pub fn make_bound_free_field_annotator(
         vec![]
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use vortex_error::VortexResult;
+
+    use super::*;
+    use crate::dtype::DType;
+    use crate::dtype::Nullability;
+    use crate::dtype::PType;
+    use crate::expr::Scope;
+    use crate::expr::Variable;
+    use crate::expr::test_harness::struct_dtype;
+    use crate::expr::var;
+
+    #[test]
+    fn a_bound_variable_accesses_no_root_fields() -> VortexResult<()> {
+        let scope_dtype = struct_dtype();
+        let fields = scope_dtype
+            .as_struct_fields_opt()
+            .vortex_expect("test scope is a struct");
+
+        let bound = var("x").bind_scope(&Scope::new(scope_dtype.clone()).with_bindings([(
+            Variable::new("x"),
+            DType::Primitive(PType::I32, Nullability::NonNullable),
+        )])?)?;
+
+        let annotator = make_bound_free_field_annotator(fields);
+        assert!(
+            annotator(&bound).is_empty(),
+            "a variable should read no root fields"
+        );
+        Ok(())
+    }
+}
diff --git a/vortex-array/src/expr/analysis/strict.rs b/vortex-array/src/expr/analysis/strict.rs
index 01cc71d91c3..8403a41c57b 100644
--- a/vortex-array/src/expr/analysis/strict.rs
+++ b/vortex-array/src/expr/analysis/strict.rs
@@ -14,8 +14,10 @@ pub fn label_strict(expr: &Expression) -> BooleanLabels<'_> {
         expr,
         |expr| match expr {
             Expression::Scalar { scalar_fn, .. } => scalar_fn.signature().is_strict(),
-            // Vacuously strict.
-            Expression::Root => true,
+            Expression::HigherOrder { .. } => false,
+            Expression::Lambda(_) => false,
+            // Vacuously strict: nullary, so no argument can be null.
+            Expression::Root | Expression::Variable { .. } => true,
         },
         |acc, &child| acc & child,
     )
diff --git a/vortex-array/src/expr/bound_expression.rs b/vortex-array/src/expr/bound_expression.rs
index 45040ab2cd1..806879199e4 100644
--- a/vortex-array/src/expr/bound_expression.rs
+++ b/vortex-array/src/expr/bound_expression.rs
@@ -11,15 +11,20 @@ use std::sync::Arc;
 use itertools::Itertools;
 use vortex_error::VortexExpect;
 use vortex_error::VortexResult;
+use vortex_error::vortex_bail;
 use vortex_error::vortex_ensure;
+use vortex_error::vortex_err;
 use vortex_session::VortexSession;
 
 use crate::dtype::DType;
 use crate::expr::Expression;
 use crate::expr::display::DisplayTreeExpr;
 use crate::expr::scope::Scope;
+use crate::expr::scope::VariableRef;
 use crate::expr::traversal::TraversalOrder;
 use crate::expr::traversal::pre_order_visit_down;
+use crate::expr::variable::Variable;
+use crate::higher_order_fn::HigherOrderFunctionRef;
 use crate::scalar_fn::ScalarFnRef;
 use crate::scalar_fn::ScalarFnVTable;
 use crate::stats::rewrite::StatsRewriteCtx;
@@ -32,17 +37,11 @@ use crate::stats::rewrite::StatsRewriteCtx;
 /// Binding is purely logical: it deals only in [`DType`]s and never sees an array, a length, or an
 /// encoding.
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
-pub struct BoundExpression {
-    kind: BoundKind,
-    dtype: DType,
-}
-
-/// The per-variant contents of a [`BoundExpression`], mirroring the logical variants of
-/// [`Expression`].
-#[derive(Clone, Debug, PartialEq, Eq, Hash)]
-pub enum BoundKind {
+pub enum BoundExpression {
     /// A scalar function applied to bound children.
     Scalar {
+        /// The dtype this node evaluates to.
+        dtype: DType,
         /// The scalar function for this node.
         scalar_fn: ScalarFnRef,
         /// The bound children, in argument order.
@@ -51,8 +50,244 @@ pub enum BoundKind {
         /// consumers from destructuring a `BoundExpression` by value.
         children: Arc<Vec<BoundExpression>>,
     },
+    /// A type-checked higher-order function call.
+    HigherOrder {
+        /// The dtype this node evaluates to.
+        dtype: DType,
+        /// The higher-order function implementation.
+        higher_order_fn: HigherOrderFunctionRef,
+        /// Bound ordinary expression children.
+        children: Arc<Vec<BoundExpression>>,
+        /// Bound lambda arguments.
+        ///
+        /// Every node is guaranteed to be [`BoundExpression::Lambda`]. They remain separate
+        /// from ordinary children because a lambda body is evaluated in its own lexical and row
+        /// domain, not in the higher-order call's row domain.
+        lambdas: Arc<[BoundExpression]>,
+    },
+    /// A type-checked lambda binder.
+    ///
+    /// A lambda reports its body dtype as its return dtype, but is not independently executable:
+    /// only a higher-order function may close it over captures and apply it to arguments.
+    Lambda { lambda: BoundLambda },
     /// The scope itself. Its dtype is the scope's root dtype.
-    Root,
+    Root {
+        /// The dtype this node evaluates to.
+        dtype: DType,
+    },
+    /// A resolved reference to a bound variable.
+    Variable {
+        /// The dtype this node evaluates to.
+        dtype: DType,
+        /// The source-level name, retained for display and diagnostics.
+        variable: Variable,
+        /// The lexical location resolved while binding.
+        variable_ref: VariableRef,
+    },
+}
+
+/// The payload of [`BoundExpression::Lambda`].
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub struct BoundLambda {
+    /// The parameters and their dtypes: the argument side of the function type.
+    params: Box<[Variable]>,
+    param_dtypes: Box<[DType]>,
+    /// The lexical locations assigned to parameters during binding.
+    param_refs: Box<[VariableRef]>,
+    /// The frame containing this lambda's parameters.
+    parameter_frame: usize,
+    body: Arc<BoundExpression>,
+}
+
+impl BoundLambda {
+    /// Bind `lambda` against a scope containing its parameter bindings.
+    ///
+    /// The higher-order function determines each parameter type and installs it in `scope`
+    /// before binding. Keeping the bindings in one scope makes that scope the single source of
+    /// truth for both the lambda body and its function signature.
+    pub fn bind(lambda: &crate::expr::Lambda, scope: &Scope) -> VortexResult<Self> {
+        vortex_ensure!(
+            scope.depth() > 0,
+            "lambda parameters must be bound in a lexical frame"
+        );
+        let parameter_frame = scope.depth() - 1;
+        let parameter_bindings = lambda
+            .params()
+            .iter()
+            .map(|param| {
+                scope
+                    .resolve(param)
+                    .map(|(dtype, variable_ref)| (dtype.clone(), variable_ref))
+                    .ok_or_else(|| {
+                        vortex_err!("lambda parameter '{param}' is not bound in its scope")
+                    })
+            })
+            .collect::<VortexResult<Vec<_>>>()?;
+        vortex_ensure!(
+            parameter_bindings
+                .iter()
+                .all(|(_, variable_ref)| variable_ref.frame() == parameter_frame),
+            "lambda parameters must be bound in the innermost lexical frame"
+        );
+        let body = lambda.body().bind_scope(scope)?;
+
+        Ok(Self {
+            params: lambda.params().to_vec().into_boxed_slice(),
+            param_dtypes: parameter_bindings
+                .iter()
+                .map(|(dtype, _)| dtype.clone())
+                .collect(),
+            param_refs: parameter_bindings
+                .into_iter()
+                .map(|(_, variable_ref)| variable_ref)
+                .collect(),
+            parameter_frame,
+            body: Arc::new(body),
+        })
+    }
+
+    /// The variables this lambda binds, in declaration order.
+    pub fn params(&self) -> &[Variable] {
+        &self.params
+    }
+
+    /// The dtypes of the parameters, in declaration order.
+    pub fn param_dtypes(&self) -> &[DType] {
+        &self.param_dtypes
+    }
+
+    /// The lexical locations of this lambda's parameters.
+    pub(crate) fn param_refs(&self) -> &[VariableRef] {
+        &self.param_refs
+    }
+
+    /// The bound body.
+    pub fn body(&self) -> &BoundExpression {
+        &self.body
+    }
+
+    /// Take the bound body when this lambda is its sole owner.
+    fn take_body(&mut self) -> Option<BoundExpression> {
+        Arc::try_unwrap(std::mem::replace(
+            &mut self.body,
+            Arc::new(BoundExpression::new_root(DType::Null)),
+        ))
+        .ok()
+    }
+
+    /// The dtype the body evaluates to — the result side of the function type.
+    pub fn body_dtype(&self) -> &DType {
+        self.body.dtype()
+    }
+
+    /// The outer lexical bindings read directly by this lambda body.
+    ///
+    /// Nested lambdas are deliberately not traversed: they become closures when their enclosing
+    /// higher-order expression is applied, at which point their own free bindings are available.
+    pub(crate) fn free_variables(&self) -> Vec<VariableRef> {
+        fn collect(
+            expr: &BoundExpression,
+            parameter_frame: usize,
+            variables: &mut Vec<VariableRef>,
+        ) {
+            match expr {
+                BoundExpression::Variable { variable_ref, .. }
+                    if variable_ref.frame() < parameter_frame
+                        && !variables.contains(variable_ref) =>
+                {
+                    variables.push(*variable_ref);
+                }
+                BoundExpression::Scalar { children, .. }
+                | BoundExpression::HigherOrder { children, .. } => {
+                    for child in children.iter() {
+                        collect(child, parameter_frame, variables);
+                    }
+                }
+                BoundExpression::Lambda { .. }
+                | BoundExpression::Root { .. }
+                | BoundExpression::Variable { .. } => {}
+            }
+        }
+
+        let mut variables = Vec::new();
+        collect(&self.body, self.parameter_frame, &mut variables);
+        variables.sort_by_key(|variable_ref| (variable_ref.frame(), variable_ref.slot()));
+        variables
+    }
+
+    /// Validate arrays supplied to this lambda's parameter frame.
+    pub(crate) fn validate_arguments(
+        &self,
+        root: &crate::ArrayRef,
+        args: &[crate::ArrayRef],
+    ) -> VortexResult<()> {
+        vortex_ensure!(
+            args.len() == self.params.len(),
+            "lambda takes {} parameters but was applied with {} arguments",
+            self.params.len(),
+            args.len()
+        );
+        for ((param, dtype), arg) in self.params.iter().zip(&self.param_dtypes).zip(args) {
+            vortex_ensure!(
+                arg.dtype() == dtype,
+                "lambda parameter '{param}' expects dtype {dtype}, got {}",
+                arg.dtype()
+            );
+            vortex_ensure!(
+                arg.len() == root.len(),
+                "lambda parameter '{param}' has length {}, expected {}",
+                arg.len(),
+                root.len()
+            );
+        }
+        Ok(())
+    }
+}
+
+impl Display for BoundLambda {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        write!(f, "({}) -> {}", self.params.iter().join(", "), self.body)
+    }
+}
+
+/// Validated bound lambda arguments owned by a higher-order expression.
+///
+/// This avoids pretending lambdas are ordinary array-valued children while giving higher-order
+/// function vtables a zero-allocation, type-safe view of their bound lambda arguments.
+#[derive(Clone, Copy)]
+pub struct BoundLambdaArgs<'a> {
+    lambdas: &'a [BoundExpression],
+}
+
+impl<'a> BoundLambdaArgs<'a> {
+    pub(crate) fn new(lambdas: &'a [BoundExpression]) -> Self {
+        debug_assert!(lambdas.iter().all(BoundExpression::is_lambda));
+        Self { lambdas }
+    }
+
+    /// Return the number of lambda arguments.
+    pub fn len(&self) -> usize {
+        self.lambdas.len()
+    }
+
+    /// Return whether there are no lambda arguments.
+    pub fn is_empty(&self) -> bool {
+        self.lambdas.is_empty()
+    }
+
+    /// Return the lambda at `index`, if any.
+    pub fn get(&self, index: usize) -> Option<&'a BoundLambda> {
+        self.lambdas.get(index).and_then(BoundExpression::as_lambda)
+    }
+
+    /// Iterate over the bound lambda arguments.
+    pub fn iter(&self) -> impl Iterator<Item = &'a BoundLambda> {
+        self.lambdas.iter().map(|lambda| {
+            lambda
+                .as_lambda()
+                .vortex_expect("validated lambda argument")
+        })
+    }
 }
 
 /// A bound-expression wrapper that compares shared tree identity instead of structure.
@@ -61,23 +296,70 @@ pub struct ExactBoundExpr(pub BoundExpression);
 
 impl PartialEq for ExactBoundExpr {
     fn eq(&self, other: &Self) -> bool {
-        match (&self.0.kind, &other.0.kind) {
-            (BoundKind::Root, BoundKind::Root) => self.0.dtype == other.0.dtype,
+        match (&self.0, &other.0) {
+            (
+                BoundExpression::Root { dtype: lhs_dtype },
+                BoundExpression::Root { dtype: rhs_dtype },
+            ) => lhs_dtype == rhs_dtype,
             (
-                BoundKind::Scalar {
+                BoundExpression::Scalar {
+                    dtype: lhs_dtype,
                     scalar_fn: lhs_fn,
                     children: lhs_children,
                 },
-                BoundKind::Scalar {
+                BoundExpression::Scalar {
+                    dtype: rhs_dtype,
                     scalar_fn: rhs_fn,
                     children: rhs_children,
                 },
             ) => {
                 lhs_fn == rhs_fn
                     && Arc::ptr_eq(lhs_children, rhs_children)
-                    && self.0.dtype == other.0.dtype
+                    && lhs_dtype == rhs_dtype
+            }
+            (
+                BoundExpression::HigherOrder {
+                    dtype: lhs_dtype,
+                    higher_order_fn: lhs_fn,
+                    children: lhs_children,
+                    lambdas: lhs_lambdas,
+                },
+                BoundExpression::HigherOrder {
+                    dtype: rhs_dtype,
+                    higher_order_fn: rhs_fn,
+                    children: rhs_children,
+                    lambdas: rhs_lambdas,
+                },
+            ) => {
+                lhs_fn == rhs_fn
+                    && Arc::ptr_eq(lhs_children, rhs_children)
+                    && Arc::ptr_eq(lhs_lambdas, rhs_lambdas)
+                    && lhs_dtype == rhs_dtype
+            }
+            (BoundExpression::Lambda { lambda: lhs }, BoundExpression::Lambda { lambda: rhs }) => {
+                lhs == rhs
             }
-            _ => false,
+            // No catch-all: a new variant must state its own identity rather than silently
+            // comparing unequal, which would put `eq` out of step with `hash`.
+            (
+                BoundExpression::Variable {
+                    dtype: lhs_dtype,
+                    variable: lhs_var,
+                    variable_ref: lhs_ref,
+                },
+                BoundExpression::Variable {
+                    dtype: rhs_dtype,
+                    variable: rhs_var,
+                    variable_ref: rhs_ref,
+                },
+            ) => lhs_var == rhs_var && lhs_ref == rhs_ref && lhs_dtype == rhs_dtype,
+            // No catch-all: a new variant must state its own identity, or `eq` drifts out of step
+            // with `hash` and keys stop equalling themselves.
+            (BoundExpression::Root { .. }, _)
+            | (BoundExpression::Scalar { .. }, _)
+            | (BoundExpression::HigherOrder { .. }, _)
+            | (BoundExpression::Lambda { .. }, _)
+            | (BoundExpression::Variable { .. }, _) => false,
         }
     }
 }
@@ -88,16 +370,41 @@ impl Hash for ExactBoundExpr {
     fn hash<H: Hasher>(&self, state: &mut H) {
         // DType differences are resolved by equality. Omitting the potentially lazy dtype keeps
         // identity-keyed cache lookups from deserializing an entire schema just to compute a hash.
-        match &self.0.kind {
-            BoundKind::Root => state.write_u8(0),
-            BoundKind::Scalar {
+        match &self.0 {
+            BoundExpression::Root { .. } => state.write_u8(0),
+            BoundExpression::Variable {
+                variable,
+                variable_ref,
+                ..
+            } => {
+                state.write_u8(2);
+                variable.hash(state);
+                variable_ref.hash(state);
+            }
+            BoundExpression::Scalar {
                 scalar_fn,
                 children,
+                ..
             } => {
                 state.write_u8(1);
                 scalar_fn.hash(state);
                 Arc::as_ptr(children).hash(state);
             }
+            BoundExpression::HigherOrder {
+                higher_order_fn,
+                children,
+                lambdas,
+                ..
+            } => {
+                state.write_u8(3);
+                higher_order_fn.hash(state);
+                Arc::as_ptr(children).hash(state);
+                Arc::as_ptr(lambdas).hash(state);
+            }
+            BoundExpression::Lambda { lambda } => {
+                state.write_u8(4);
+                lambda.hash(state);
+            }
         }
     }
 }
@@ -105,10 +412,7 @@ impl Hash for ExactBoundExpr {
 impl BoundExpression {
     /// Create a bound root expression with the given dtype.
     pub fn new_root(dtype: DType) -> Self {
-        Self {
-            kind: BoundKind::Root,
-            dtype,
-        }
+        Self::Root { dtype }
     }
 
     /// Create a bound scalar node from a scalar function and already-bound children.
@@ -123,6 +427,10 @@ impl BoundExpression {
             scalar_fn.signature().arity(),
             children.len()
         );
+        vortex_ensure!(
+            children.iter().all(|child| !child.is_lambda()),
+            "a scalar function cannot take a lambda as an ordinary argument"
+        );
 
         let arg_dtypes = children
             .iter()
@@ -130,12 +438,52 @@ impl BoundExpression {
             .collect_vec();
         let dtype = scalar_fn.return_dtype(&arg_dtypes)?;
 
-        Ok(Self {
-            kind: BoundKind::Scalar {
-                scalar_fn,
-                children: children.into(),
-            },
+        Ok(Self::Scalar {
+            dtype,
+            scalar_fn,
+            children: children.into(),
+        })
+    }
+
+    /// Create a bound higher-order node from its bound children and lambdas.
+    pub fn try_new_higher_order(
+        higher_order_fn: HigherOrderFunctionRef,
+        children: impl IntoIterator<Item = BoundExpression>,
+        lambdas: impl Into<Box<[BoundExpression]>>,
+    ) -> VortexResult<Self> {
+        let children = Vec::from_iter(children);
+        let lambdas: Arc<[BoundExpression]> = Arc::from(lambdas.into());
+        vortex_ensure!(
+            higher_order_fn.arity().matches(children.len()),
+            "Higher-order expression arity mismatch: expected {} children but got {}",
+            higher_order_fn.arity(),
+            children.len()
+        );
+        vortex_ensure!(
+            children.iter().all(|child| !child.is_lambda()),
+            "a higher-order function cannot take a lambda as an ordinary argument"
+        );
+        vortex_ensure!(
+            higher_order_fn.lambda_arity() == lambdas.len(),
+            "Higher-order expression lambda arity mismatch: expected {} lambdas but got {}",
+            higher_order_fn.lambda_arity(),
+            lambdas.len()
+        );
+        vortex_ensure!(
+            lambdas.iter().all(BoundExpression::is_lambda),
+            "Higher-order expression '{}' requires bound lambda arguments",
+            higher_order_fn.id(),
+        );
+        let arg_dtypes = children
+            .iter()
+            .map(|child| child.dtype().clone())
+            .collect_vec();
+        let dtype = higher_order_fn.return_dtype(&arg_dtypes, BoundLambdaArgs::new(&lambdas))?;
+        Ok(Self::HigherOrder {
             dtype,
+            higher_order_fn,
+            children: children.into(),
+            lambdas,
         })
     }
 
@@ -145,33 +493,44 @@ impl BoundExpression {
         children: impl IntoIterator<Item = BoundExpression>,
     ) -> VortexResult<Self> {
         let children = Vec::from_iter(children);
-        let BoundKind::Scalar { scalar_fn, .. } = &self.kind else {
-            vortex_ensure!(
-                children.is_empty(),
-                "Root expression cannot have {} children",
-                children.len()
-            );
-            return Ok(self);
-        };
-
-        Self::try_new(scalar_fn.clone(), children)
+        match &self {
+            BoundExpression::Scalar { scalar_fn, .. } => Self::try_new(scalar_fn.clone(), children),
+            BoundExpression::HigherOrder {
+                higher_order_fn,
+                lambdas,
+                ..
+            } => Self::try_new_higher_order(higher_order_fn.clone(), children, lambdas.to_vec()),
+            BoundExpression::Lambda { .. }
+            | BoundExpression::Root { .. }
+            | BoundExpression::Variable { .. } => {
+                vortex_ensure!(
+                    children.is_empty(),
+                    "{self} cannot have {} children",
+                    children.len()
+                );
+                Ok(self)
+            }
+        }
     }
 
     /// The dtype this expression evaluates to.
     pub fn dtype(&self) -> &DType {
-        &self.dtype
-    }
-
-    /// The per-variant contents of this node.
-    pub fn kind(&self) -> &BoundKind {
-        &self.kind
+        match self {
+            Self::Scalar { dtype, .. }
+            | Self::HigherOrder { dtype, .. }
+            | Self::Root { dtype }
+            | Self::Variable { dtype, .. } => dtype,
+            Self::Lambda { lambda } => lambda.body_dtype(),
+        }
     }
 
-    /// The bound children of this node, in argument order. Empty for [`BoundKind::Root`].
+    /// The bound children of this node, in argument order. Empty for [`BoundExpression::Root`].
     pub fn children(&self) -> &[BoundExpression] {
-        match &self.kind {
-            BoundKind::Scalar { children, .. } => children.as_slice(),
-            BoundKind::Root => &[],
+        match self {
+            Self::Scalar { children, .. } | Self::HigherOrder { children, .. } => {
+                children.as_slice()
+            }
+            Self::Lambda { .. } | Self::Root { .. } | Self::Variable { .. } => &[],
         }
     }
 
@@ -182,12 +541,55 @@ impl BoundExpression {
 
     /// The scalar function for this node, or `None` if it is the scope root.
     pub fn as_scalar(&self) -> Option<&ScalarFnRef> {
-        match &self.kind {
-            BoundKind::Scalar { scalar_fn, .. } => Some(scalar_fn),
-            BoundKind::Root => None,
+        match self {
+            Self::Scalar { scalar_fn, .. } => Some(scalar_fn),
+            Self::HigherOrder { .. }
+            | Self::Lambda { .. }
+            | Self::Root { .. }
+            | Self::Variable { .. } => None,
+        }
+    }
+
+    /// The higher-order function for this node, if any.
+    pub fn as_higher_order(&self) -> Option<&HigherOrderFunctionRef> {
+        match self {
+            Self::HigherOrder {
+                higher_order_fn, ..
+            } => Some(higher_order_fn),
+            Self::Scalar { .. }
+            | Self::Lambda { .. }
+            | Self::Root { .. }
+            | Self::Variable { .. } => None,
+        }
+    }
+
+    /// The bound lambda arguments of this node.
+    pub fn lambdas(&self) -> &[BoundExpression] {
+        match self {
+            Self::HigherOrder { lambdas, .. } => lambdas,
+            Self::Scalar { .. }
+            | Self::Lambda { .. }
+            | Self::Root { .. }
+            | Self::Variable { .. } => &[],
         }
     }
 
+    /// Return this node's bound lambda, if it is a lambda binder.
+    pub fn as_lambda(&self) -> Option<&BoundLambda> {
+        match self {
+            Self::Lambda { lambda } => Some(lambda),
+            Self::Scalar { .. }
+            | Self::HigherOrder { .. }
+            | Self::Root { .. }
+            | Self::Variable { .. } => None,
+        }
+    }
+
+    /// Whether this node is a bound lambda binder.
+    pub fn is_lambda(&self) -> bool {
+        self.as_lambda().is_some()
+    }
+
     /// Return whether this node uses the given scalar-function vtable.
     pub fn is<V: ScalarFnVTable>(&self) -> bool {
         self.as_scalar().is_some_and(ScalarFnRef::is::<V>)
@@ -221,9 +623,20 @@ impl BoundExpression {
             .vortex_expect("Bound expression options type mismatch")
     }
 
+    /// The variable this node resolves to, if this node is a variable reference.
+    pub fn as_variable(&self) -> Option<&Variable> {
+        match self {
+            Self::Variable { variable, .. } => Some(variable),
+            Self::Scalar { .. }
+            | Self::HigherOrder { .. }
+            | Self::Lambda { .. }
+            | Self::Root { .. } => None,
+        }
+    }
+
     /// Whether this node is the scope root.
     pub fn is_root(&self) -> bool {
-        matches!(self.kind, BoundKind::Root)
+        matches!(self, Self::Root { .. })
     }
 
     /// Return whether every scope root in this expression has `dtype`.
@@ -260,9 +673,14 @@ impl BoundExpression {
 
 impl Display for BoundExpression {
     fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
-        match self.kind() {
-            BoundKind::Scalar { scalar_fn, .. } => scalar_fn.fmt_sql(self, f),
-            BoundKind::Root => f.write_str("$"),
+        match self {
+            Self::Scalar { scalar_fn, .. } => scalar_fn.fmt_sql(self, f),
+            Self::HigherOrder {
+                higher_order_fn, ..
+            } => higher_order_fn.fmt_sql(self, f),
+            Self::Lambda { lambda } => Display::fmt(lambda, f),
+            Self::Root { .. } => f.write_str("$"),
+            Self::Variable { variable, .. } => write!(f, "${variable}"),
         }
     }
 }
@@ -279,55 +697,139 @@ impl Expression {
 
     /// Bind this expression against an explicit [`Scope`].
     pub fn bind_scope(&self, scope: &Scope) -> VortexResult<BoundExpression> {
-        if self.is_root() {
-            return Ok(BoundExpression::new_root(scope.root().clone()));
+        match self {
+            Expression::Root => Ok(BoundExpression::new_root(scope.root().clone())),
+            Expression::Variable(variable) => {
+                let Some((dtype, variable_ref)) = scope.resolve(variable) else {
+                    vortex_bail!("unbound variable '{variable}'");
+                };
+                Ok(BoundExpression::Variable {
+                    dtype: dtype.clone(),
+                    variable: variable.clone(),
+                    variable_ref,
+                })
+            }
+            Expression::Scalar {
+                scalar_fn,
+                children,
+            } => {
+                let children: Vec<_> = children
+                    .iter()
+                    .map(|child| child.bind_scope(scope))
+                    .try_collect()?;
+                BoundExpression::try_new(scalar_fn.clone(), children)
+            }
+            Expression::HigherOrder {
+                higher_order_fn,
+                children,
+                lambdas,
+            } => {
+                let children: Vec<_> = children
+                    .iter()
+                    .map(|child| child.bind_scope(scope))
+                    .try_collect()?;
+                let dtypes = children
+                    .iter()
+                    .map(|child| child.dtype().clone())
+                    .collect_vec();
+                let lambda_syntax = lambdas
+                    .iter()
+                    .map(|lambda| {
+                        lambda.as_lambda().ok_or_else(|| {
+                            vortex_err!(
+                                "higher-order expression '{}' received a non-lambda argument",
+                                higher_order_fn.id()
+                            )
+                        })
+                    })
+                    .collect::<VortexResult<Vec<_>>>()?;
+                let signatures = higher_order_fn.lambda_signatures(&dtypes, &lambda_syntax)?;
+                vortex_ensure!(
+                    signatures.len() == lambda_syntax.len(),
+                    "higher-order function '{}' produced {} lambda signatures for {} lambda arguments",
+                    higher_order_fn.id(),
+                    signatures.len(),
+                    lambda_syntax.len(),
+                );
+                let lambdas = lambda_syntax
+                    .into_iter()
+                    .zip(signatures.iter())
+                    .map(|(lambda, signature)| {
+                        signature
+                            .bind(lambda, scope)
+                            .map(|lambda| BoundExpression::Lambda { lambda })
+                    })
+                    .collect::<VortexResult<Vec<_>>>()?;
+                BoundExpression::try_new_higher_order(higher_order_fn.clone(), children, lambdas)
+            }
+            Expression::Lambda(_) => {
+                vortex_bail!("a lambda can be bound only as an argument to a higher-order function")
+            }
         }
+    }
+}
 
-        let children: Vec<_> = self
-            .children()
-            .iter()
-            .map(|child| child.bind_scope(scope))
-            .try_collect()?;
-        let scalar_fn = self
-            .as_scalar()
-            .vortex_expect("root was handled above, so this is a scalar node");
-        BoundExpression::try_new(scalar_fn.clone(), children)
+fn drain_bound_drop_children(expression: &mut BoundExpression, to_drop: &mut Vec<BoundExpression>) {
+    match expression {
+        BoundExpression::Scalar { children, .. } => {
+            if let Some(children) = Arc::get_mut(children) {
+                to_drop.append(children);
+            }
+        }
+        BoundExpression::HigherOrder {
+            children, lambdas, ..
+        } => {
+            if let Some(children) = Arc::get_mut(children) {
+                to_drop.append(children);
+            }
+            if let Some(lambdas) = Arc::get_mut(lambdas) {
+                for lambda in lambdas {
+                    if let BoundExpression::Lambda { lambda } = lambda
+                        && let Some(body) = lambda.take_body()
+                    {
+                        to_drop.push(body);
+                    }
+                }
+            }
+        }
+        BoundExpression::Lambda { lambda } => {
+            if let Some(body) = lambda.take_body() {
+                to_drop.push(body);
+            }
+        }
+        BoundExpression::Root { .. } | BoundExpression::Variable { .. } => {}
     }
 }
 
-/// Iterative drop to avoid stack overflows on deep trees.
+/// Iterative drop to avoid stack overflows on deep value trees and lambda bodies.
 impl Drop for BoundExpression {
     fn drop(&mut self) {
-        let BoundKind::Scalar { children, .. } = &mut self.kind else {
-            return;
-        };
-        let Some(children) = Arc::get_mut(children) else {
-            return;
-        };
-
-        let mut to_drop = std::mem::take(children);
-        while let Some(mut child) = to_drop.pop() {
-            if let BoundKind::Scalar { children, .. } = &mut child.kind
-                && let Some(grandchildren) = Arc::get_mut(children)
-            {
-                to_drop.append(grandchildren);
-            }
+        let mut to_drop = Vec::new();
+        drain_bound_drop_children(self, &mut to_drop);
+        while let Some(mut expression) = to_drop.pop() {
+            drain_bound_drop_children(&mut expression, &mut to_drop);
         }
     }
 }
 
 #[cfg(test)]
 mod tests {
+    use vortex_error::VortexExpect;
     use vortex_error::VortexResult;
 
     use super::*;
     use crate::dtype::Nullability;
     use crate::dtype::PType;
+    use crate::expr::checked_add;
     use crate::expr::col;
     use crate::expr::eq;
+    use crate::expr::lambda;
+    use crate::expr::list_transform;
     use crate::expr::lit;
     use crate::expr::root;
     use crate::expr::test_harness::struct_dtype;
+    use crate::expr::var;
+    use crate::scalar_fn::fns::is_not_null::IsNotNull;
     use crate::scalar_fn::fns::literal::Literal;
 
     fn scope() -> Scope {
@@ -407,25 +909,113 @@ mod tests {
     }
 
     #[test]
-    fn clone_shares_children() -> VortexResult<()> {
-        let bound = eq(col("a"), lit(1_i32)).bind_scope(&scope())?;
-        let cloned = bound.clone();
-
-        let (BoundKind::Scalar { children: a, .. }, BoundKind::Scalar { children: b, .. }) =
-            (bound.kind(), cloned.kind())
-        else {
-            unreachable!("eq is a scalar node")
-        };
-        assert!(Arc::ptr_eq(a, b));
+    fn variable_binds_to_its_scope() -> VortexResult<()> {
+        let scope = scope().with_bindings([(
+            Variable::new("value"),
+            DType::Primitive(PType::I64, Nullability::Nullable),
+        )])?;
+
+        let bound = var("value").bind_scope(&scope)?;
+        let variable = bound
+            .as_variable()
+            .vortex_expect("variable must remain bound");
+
+        assert_eq!(variable, &Variable::new("value"));
+        assert_eq!(
+            bound.dtype(),
+            &DType::Primitive(PType::I64, Nullability::Nullable)
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn variable_validity_is_deferred_to_its_bound_array() -> VortexResult<()> {
+        let scope = scope().with_bindings([(
+            Variable::new("value"),
+            DType::Primitive(PType::I32, Nullability::Nullable),
+        )])?;
+        let expression = checked_add(var("value"), lit(1_i32));
+
+        let validity = expression.validity()?;
+        assert!(validity.contains::<IsNotNull>()?);
+        assert_eq!(
+            validity.bind_scope(&scope)?.dtype(),
+            &DType::Bool(Nullability::NonNullable)
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn duplicate_lambda_parameters_are_rejected() {
+        assert!(lambda(["x", "x"], var("x")).is_err());
+    }
+
+    #[test]
+    fn lambda_signature_comes_from_its_scope() -> VortexResult<()> {
+        let lambda = lambda(["value"], var("value"))?;
+        let lambda = lambda
+            .as_lambda()
+            .vortex_expect("lambda factory must return lambda syntax");
+        let value_dtype = DType::Primitive(PType::I64, Nullability::Nullable);
+        let lambda_scope =
+            scope().with_bindings([(Variable::new("value"), value_dtype.clone())])?;
+
+        let bound = BoundLambda::bind(lambda, &lambda_scope)?;
+        assert_eq!(bound.body_dtype(), &value_dtype);
+        assert_eq!(bound.param_dtypes(), &[value_dtype]);
+        assert!(BoundLambda::bind(lambda, &scope()).is_err());
         Ok(())
     }
 
     #[test]
-    fn repeated_subtree_is_bound_per_occurrence() -> VortexResult<()> {
-        let shared = col("a");
-        let bound = eq(shared.clone(), shared).bind_scope(&scope())?;
-        let children = bound.children();
-        assert_eq!(children[0].dtype(), children[1].dtype());
+    fn lambda_captures_only_direct_free_variables() -> VortexResult<()> {
+        let dtype = DType::Primitive(PType::I32, Nullability::NonNullable);
+        let lambda_scope = scope()
+            .with_bindings([(Variable::new("outer"), dtype.clone())])?
+            .with_bindings([(Variable::new("middle"), dtype.clone())])?
+            .with_bindings([(Variable::new("value"), dtype)])?;
+        let lambda = lambda(
+            ["value"],
+            checked_add(checked_add(var("value"), var("middle")), var("outer")),
+        )?;
+        let lambda = lambda
+            .as_lambda()
+            .vortex_expect("lambda factory must return lambda syntax");
+
+        let typed = BoundLambda::bind(lambda, &lambda_scope)?;
+        let free_variables = typed.free_variables();
+
+        assert_eq!(free_variables.len(), 2);
+        assert_eq!(
+            free_variables
+                .iter()
+                .map(|variable_ref| (variable_ref.frame(), variable_ref.slot()))
+                .collect_vec(),
+            vec![(0, 0), (1, 0)]
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn higher_order_binding_materializes_lambda_nodes() -> VortexResult<()> {
+        let expression = list_transform(
+            root(),
+            lambda(["element"], checked_add(var("element"), lit(1_i32)))?,
+        )?;
+        let input_dtype = DType::List(
+            DType::Primitive(PType::I32, Nullability::NonNullable).into(),
+            Nullability::NonNullable,
+        );
+
+        let bound = expression.bind(&input_dtype)?;
+        assert_eq!(bound.children().len(), 1);
+        let lambda = bound.lambdas()[0]
+            .as_lambda()
+            .vortex_expect("higher-order lambdas bind as bound-expression nodes");
+        assert_eq!(
+            lambda.param_dtypes(),
+            &[DType::Primitive(PType::I32, Nullability::NonNullable)]
+        );
         Ok(())
     }
 
@@ -443,7 +1033,6 @@ mod tests {
 
     #[test]
     fn binding_reports_a_type_error() {
-        let expr = eq(col("a"), lit("nope"));
-        assert!(expr.bind_scope(&scope()).is_err());
+        assert!(eq(col("a"), lit("nope")).bind_scope(&scope()).is_err());
     }
 }
diff --git a/vortex-array/src/expr/display.rs b/vortex-array/src/expr/display.rs
index 345f393e779..2ac51fb1c7e 100644
--- a/vortex-array/src/expr/display.rs
+++ b/vortex-array/src/expr/display.rs
@@ -9,7 +9,6 @@ use vortex_utils::tree::TreeDisplayAdapter;
 use vortex_utils::tree::write_branch_tree;
 
 use crate::expr::BoundExpression;
-use crate::expr::BoundKind;
 use crate::expr::Expression;
 use crate::scalar_fn::ChildName;
 
@@ -30,6 +29,18 @@ pub trait ExprDisplay: Display {
     fn display_children_count(&self) -> usize;
 }
 
+/// Read-only higher-order-expression interface used for SQL-style formatting.
+///
+/// Lambdas are deliberately separate from ordinary children: a higher-order function establishes
+/// their parameter scope, so callers must never mistake a lambda body for an ordinary argument.
+pub trait HigherOrderExprDisplay: ExprDisplay {
+    /// Return the lambda at `index`.
+    fn display_lambda(&self, index: usize) -> &dyn Display;
+
+    /// Return the number of lambda arguments.
+    fn display_lambdas_count(&self) -> usize;
+}
+
 impl ExprDisplay for Expression {
     fn display_child(&self, index: usize) -> &dyn ExprDisplay {
         Expression::child(self, index)
@@ -50,6 +61,54 @@ impl ExprDisplay for BoundExpression {
     }
 }
 
+impl HigherOrderExprDisplay for Expression {
+    fn display_lambda(&self, index: usize) -> &dyn Display {
+        match self {
+            Expression::HigherOrder { lambdas, .. } => &lambdas[index],
+            Expression::Scalar { .. }
+            | Expression::Lambda(_)
+            | Expression::Root
+            | Expression::Variable(_) => {
+                unreachable!("only higher-order expressions have lambda arguments")
+            }
+        }
+    }
+
+    fn display_lambdas_count(&self) -> usize {
+        match self {
+            Expression::HigherOrder { lambdas, .. } => lambdas.len(),
+            Expression::Scalar { .. }
+            | Expression::Lambda(_)
+            | Expression::Root
+            | Expression::Variable(_) => 0,
+        }
+    }
+}
+
+impl HigherOrderExprDisplay for BoundExpression {
+    fn display_lambda(&self, index: usize) -> &dyn Display {
+        match self {
+            BoundExpression::HigherOrder { lambdas, .. } => &lambdas[index],
+            BoundExpression::Scalar { .. }
+            | BoundExpression::Lambda { .. }
+            | BoundExpression::Root { .. }
+            | BoundExpression::Variable { .. } => {
+                unreachable!("only higher-order expressions have lambda arguments")
+            }
+        }
+    }
+
+    fn display_lambdas_count(&self) -> usize {
+        match self {
+            BoundExpression::HigherOrder { lambdas, .. } => lambdas.len(),
+            BoundExpression::Scalar { .. }
+            | BoundExpression::Lambda { .. }
+            | BoundExpression::Root { .. }
+            | BoundExpression::Variable { .. } => 0,
+        }
+    }
+}
+
 trait DisplayTreeNode: Sized {
     fn tree_children(&self) -> &[Self];
 
@@ -69,14 +128,24 @@ impl DisplayTreeNode for Expression {
     fn tree_child_name(&self, index: usize) -> ChildName {
         match self {
             Expression::Scalar { scalar_fn, .. } => scalar_fn.signature().child_name(index),
-            Expression::Root => unreachable!("the scope root has no children"),
+            Expression::HigherOrder {
+                higher_order_fn, ..
+            } => higher_order_fn.child_name(index),
+            Expression::Lambda(_) | Expression::Root | Expression::Variable(_) => {
+                unreachable!("a leaf expression has no children")
+            }
         }
     }
 
     fn fmt_tree_node(&self, f: &mut Formatter<'_>) -> fmt::Result {
         match self {
             Expression::Scalar { scalar_fn, .. } => Display::fmt(scalar_fn, f),
+            Expression::HigherOrder {
+                higher_order_fn, ..
+            } => Display::fmt(higher_order_fn, f),
+            Expression::Lambda(lambda) => Display::fmt(lambda, f),
             Expression::Root => write!(f, "{ROOT_DISPLAY}"),
+            Expression::Variable(variable) => write!(f, "${variable}"),
         }
     }
 }
@@ -87,16 +156,28 @@ impl DisplayTreeNode for BoundExpression {
     }
 
     fn tree_child_name(&self, index: usize) -> ChildName {
-        match self.kind() {
-            BoundKind::Scalar { scalar_fn, .. } => scalar_fn.signature().child_name(index),
-            BoundKind::Root => unreachable!("the scope root has no children"),
+        match self {
+            BoundExpression::Scalar { scalar_fn, .. } => scalar_fn.signature().child_name(index),
+            BoundExpression::HigherOrder {
+                higher_order_fn, ..
+            } => higher_order_fn.child_name(index),
+            BoundExpression::Lambda { .. }
+            | BoundExpression::Root { .. }
+            | BoundExpression::Variable { .. } => {
+                unreachable!("a leaf bound node has no children")
+            }
         }
     }
 
     fn fmt_tree_node(&self, f: &mut Formatter<'_>) -> fmt::Result {
-        match self.kind() {
-            BoundKind::Scalar { scalar_fn, .. } => Display::fmt(scalar_fn, f),
-            BoundKind::Root => write!(f, "{ROOT_DISPLAY}"),
+        match self {
+            BoundExpression::Scalar { scalar_fn, .. } => Display::fmt(scalar_fn, f),
+            BoundExpression::HigherOrder {
+                higher_order_fn, ..
+            } => Display::fmt(higher_order_fn, f),
+            BoundExpression::Lambda { lambda } => Display::fmt(lambda, f),
+            BoundExpression::Root { .. } => write!(f, "{ROOT_DISPLAY}"),
+            BoundExpression::Variable { variable, .. } => write!(f, "${variable}"),
         }
     }
 }
diff --git a/vortex-array/src/expr/expression.rs b/vortex-array/src/expr/expression.rs
index db1a76853cd..34273710225 100644
--- a/vortex-array/src/expr/expression.rs
+++ b/vortex-array/src/expr/expression.rs
@@ -8,15 +8,19 @@ use std::fmt::Formatter;
 use std::hash::Hash;
 use std::sync::Arc;
 
-use itertools::Itertools;
 use vortex_error::VortexExpect;
 use vortex_error::VortexResult;
 use vortex_error::vortex_ensure;
 
 use crate::dtype::DType;
 use crate::expr::display::DisplayTreeExpr;
+use crate::expr::is_not_null;
+use crate::expr::lambda::Lambda;
+use crate::expr::scope::Scope;
 use crate::expr::traversal::TraversalOrder;
 use crate::expr::traversal::pre_order_visit_down;
+use crate::expr::variable::Variable;
+use crate::higher_order_fn::HigherOrderFunctionRef;
 use crate::scalar_fn::ScalarFnRef;
 use crate::scalar_fn::ScalarFnVTable;
 
@@ -38,8 +42,20 @@ pub enum Expression {
         /// Any children of this expression.
         children: Arc<Vec<Expression>>,
     },
+    /// A higher-order function applied to ordinary children and owned lambda syntax.
+    HigherOrder {
+        higher_order_fn: HigherOrderFunctionRef,
+        children: Arc<Vec<Expression>>,
+        lambdas: Arc<Vec<Expression>>,
+    },
+    /// Lambda syntax. A lambda is a binder, not an array-valued expression.
+    ///
+    /// It can be bound only by a higher-order function that supplies its parameter signature.
+    Lambda(Lambda),
     /// The full scope of the expression evaluation.
     Root,
+    /// A name to be bound to a value.
+    Variable(Variable),
 }
 
 impl Expression {
@@ -56,6 +72,10 @@ impl Expression {
             scalar_fn.signature().arity(),
             children.len()
         );
+        vortex_ensure!(
+            children.iter().all(|child| !child.is_lambda()),
+            "a scalar function cannot take a lambda as an ordinary argument"
+        );
 
         Ok(Self::Scalar {
             scalar_fn,
@@ -63,16 +83,93 @@ impl Expression {
         })
     }
 
+    /// Create a higher-order function from ordinary children and owned lambdas.
+    pub fn try_new_higher_order(
+        higher_order_fn: HigherOrderFunctionRef,
+        children: impl IntoIterator<Item = Expression>,
+        lambdas: impl IntoIterator<Item = Expression>,
+    ) -> VortexResult<Self> {
+        let children = Vec::from_iter(children);
+        let lambdas = Vec::from_iter(lambdas);
+        vortex_ensure!(
+            higher_order_fn.arity().matches(children.len()),
+            "Higher-order expression arity mismatch: expected {} children but got {}",
+            higher_order_fn.arity(),
+            children.len()
+        );
+        vortex_ensure!(
+            children.iter().all(|child| !child.is_lambda()),
+            "a higher-order function cannot take a lambda as an ordinary argument"
+        );
+        vortex_ensure!(
+            higher_order_fn.lambda_arity() == lambdas.len(),
+            "Higher-order expression lambda arity mismatch: expected {} lambdas but got {}",
+            higher_order_fn.lambda_arity(),
+            lambdas.len()
+        );
+        vortex_ensure!(
+            lambdas.iter().all(Expression::is_lambda),
+            "Higher-order expression '{}' requires lambda arguments",
+            higher_order_fn.id(),
+        );
+        Ok(Self::HigherOrder {
+            higher_order_fn,
+            children: children.into(),
+            lambdas: lambdas.into(),
+        })
+    }
+
     /// Whether this expression is the scope root.
     pub fn is_root(&self) -> bool {
         matches!(self, Self::Root)
     }
 
+    /// The variable this expression references, if it is a variable.
+    pub fn as_variable(&self) -> Option<&Variable> {
+        match self {
+            Self::Variable(variable) => Some(variable),
+            _ => None,
+        }
+    }
+
+    pub fn as_higher_order(&self) -> Option<&HigherOrderFunctionRef> {
+        match self {
+            Self::HigherOrder {
+                higher_order_fn, ..
+            } => Some(higher_order_fn),
+            _ => None,
+        }
+    }
+
+    /// Return this node's lambda syntax if it is a lambda.
+    pub fn as_lambda(&self) -> Option<&Lambda> {
+        match self {
+            Self::Lambda(lambda) => Some(lambda),
+            Self::Scalar { .. } | Self::HigherOrder { .. } | Self::Root | Self::Variable(_) => None,
+        }
+    }
+
+    /// Whether this node is lambda syntax.
+    pub fn is_lambda(&self) -> bool {
+        self.as_lambda().is_some()
+    }
+
+    /// Return the lambda arguments owned by this higher-order expression.
+    ///
+    /// Each returned node is guaranteed to be [`Expression::Lambda`]. They are deliberately
+    /// separate from [`Self::children`], which is the row-domain value tree.
+    pub fn lambdas(&self) -> &[Expression] {
+        match self {
+            Self::HigherOrder { lambdas, .. } => lambdas,
+            _ => &[],
+        }
+    }
+
     /// Returns the scalar fn for this expression, or `None` if it is not a scalar node.
     pub fn as_scalar(&self) -> Option<&ScalarFnRef> {
         match self {
             Self::Scalar { scalar_fn, .. } => Some(scalar_fn),
-            Self::Root => None,
+            _ => None,
         }
     }
 
@@ -96,11 +193,13 @@ impl Expression {
             .vortex_expect("Expression options type mismatch")
     }
 
-    /// Returns the children of this expression.
+    /// Returns the sub-expressions of this node.
     pub fn children(&self) -> &[Expression] {
         match self {
-            Self::Scalar { children, .. } => children.as_slice(),
-            Self::Root => NO_CHILDREN,
+            Self::Scalar { children, .. } | Self::HigherOrder { children, .. } => {
+                children.as_slice()
+            }
+            Self::Lambda(_) | Self::Root | Self::Variable(_) => NO_CHILDREN,
         }
     }
 
@@ -116,44 +215,53 @@ impl Expression {
     ) -> VortexResult<Self> {
         let children = Vec::from_iter(children);
         match &self {
-            Self::Root => {
+            Self::Scalar { scalar_fn, .. } => Self::try_new(scalar_fn.clone(), children),
+            Self::HigherOrder {
+                higher_order_fn,
+                lambdas,
+                ..
+            } => Self::try_new_higher_order(higher_order_fn.clone(), children, lambdas.to_vec()),
+            Self::Lambda(_) | Self::Root | Self::Variable(_) => {
                 vortex_ensure!(
                     children.is_empty(),
-                    "Expression arity mismatch: root expects 0 children but got {}",
+                    "Expression arity mismatch: a leaf expects 0 children but got {}",
                     children.len()
                 );
-                Ok(Self::Root)
+                Ok(self)
             }
-            Self::Scalar { scalar_fn, .. } => {
+        }
+    }
+
+    /// Replace the lambda arguments of a higher-order expression.
+    pub(crate) fn with_lambdas(
+        self,
+        lambdas: impl IntoIterator<Item = Expression>,
+    ) -> VortexResult<Self> {
+        let lambdas = Vec::from_iter(lambdas);
+        match &self {
+            Self::HigherOrder {
+                higher_order_fn,
+                children,
+                ..
+            } => Self::try_new_higher_order(higher_order_fn.clone(), children.to_vec(), lambdas),
+            Self::Scalar { .. } | Self::Lambda(_) | Self::Root | Self::Variable(_) => {
                 vortex_ensure!(
-                    scalar_fn.signature().arity().matches(children.len()),
-                    "Expression arity mismatch: expected {} children but got {}",
-                    scalar_fn.signature().arity(),
-                    children.len()
+                    lambdas.is_empty(),
+                    "only a higher-order expression can have lambda arguments"
                 );
-                Ok(Self::Scalar {
-                    scalar_fn: scalar_fn.clone(),
-                    children: children.into(),
-                })
+                Ok(self)
             }
         }
     }
 
     /// Computes the return dtype of this expression given the input dtype.
     pub fn return_dtype(&self, scope: &DType) -> VortexResult<DType> {
-        match self {
-            Self::Root => Ok(scope.clone()),
-            Self::Scalar {
-                scalar_fn,
-                children,
-            } => {
-                let dtypes: Vec<_> = children
-                    .iter()
-                    .map(|c| c.return_dtype(scope))
-                    .try_collect()?;
-                scalar_fn.return_dtype(&dtypes)
-            }
-        }
+        self.return_dtype_scope(&Scope::new(scope.clone()))
+    }
+
+    /// Computes the return dtype of this expression against a lexical scope.
+    pub fn return_dtype_scope(&self, scope: &Scope) -> VortexResult<DType> {
+        Ok(self.bind_scope(scope)?.dtype().clone())
     }
 
     /// Returns a new expression representing the validity mask output of this expression.
@@ -163,7 +271,14 @@ impl Expression {
         match self {
             // The scope is exactly as valid as itself.
             Self::Root => Ok(Self::Root),
+            // This is evaluated later against the array bound to the variable by a higher-order
+            // function, yielding that array's validity as a non-nullable boolean mask.
+            Self::Variable(_) => Ok(is_not_null(self.clone())),
+            Self::HigherOrder { .. } => Ok(is_not_null(self.clone())),
             Self::Scalar { scalar_fn, .. } => scalar_fn.validity(self),
+            Self::Lambda(_) => vortex_error::vortex_bail!(
+                "a lambda has no standalone validity expression; it must be applied by a higher-order function"
+            ),
         }
     }
 
@@ -174,6 +289,11 @@ impl Expression {
     pub fn fmt_sql(&self, f: &mut Formatter<'_>) -> fmt::Result {
         match self {
             Self::Root => write!(f, "$"),
+            Self::Variable(variable) => write!(f, "${variable}"),
+            Self::Lambda(lambda) => Display::fmt(lambda, f),
+            Self::HigherOrder {
+                higher_order_fn, ..
+            } => higher_order_fn.fmt_sql(self, f),
             Self::Scalar { scalar_fn, .. } => scalar_fn.fmt_sql(self, f),
         }
     }
@@ -266,23 +386,45 @@ impl Display for Expression {
     }
 }
 
-/// Iterative drop for expression to avoid stack overflows.
+fn drain_drop_children(expression: &mut Expression, to_drop: &mut Vec<Expression>) {
+    match expression {
+        Expression::Scalar { children, .. } => {
+            if let Some(children) = Arc::get_mut(children) {
+                to_drop.append(children);
+            }
+        }
+        Expression::HigherOrder {
+            children, lambdas, ..
+        } => {
+            if let Some(children) = Arc::get_mut(children) {
+                to_drop.append(children);
+            }
+            if let Some(lambdas) = Arc::get_mut(lambdas) {
+                for lambda in lambdas {
+                    if let Expression::Lambda(lambda) = lambda
+                        && let Some(body) = lambda.take_body()
+                    {
+                        to_drop.push(body);
+                    }
+                }
+            }
+        }
+        Expression::Lambda(lambda) => {
+            if let Some(body) = lambda.take_body() {
+                to_drop.push(body);
+            }
+        }
+        Expression::Root | Expression::Variable(_) => {}
+    }
+}
+
+/// Iterative drop for expression to avoid stack overflows, including binder-owned lambda bodies.
 impl Drop for Expression {
     fn drop(&mut self) {
-        let Self::Scalar { children, .. } = self else {
-            return;
-        };
-        let Some(children) = Arc::get_mut(children) else {
-            return;
-        };
-
-        let mut children_to_drop = std::mem::take(children);
-        while let Some(mut child) = children_to_drop.pop() {
-            if let Self::Scalar { children, .. } = &mut child
-                && let Some(expr_children) = Arc::get_mut(children)
-            {
-                children_to_drop.append(expr_children);
-            }
+        let mut to_drop = Vec::new();
+        drain_drop_children(self, &mut to_drop);
+        while let Some(mut expression) = to_drop.pop() {
+            drain_drop_children(&mut expression, &mut to_drop);
         }
     }
 }
diff --git a/vortex-array/src/expr/exprs.rs b/vortex-array/src/expr/exprs.rs
index fb8bfe227aa..8bf8ab2e575 100644
--- a/vortex-array/src/expr/exprs.rs
+++ b/vortex-array/src/expr/exprs.rs
@@ -17,6 +17,11 @@ use crate::dtype::FieldNames;
 use crate::dtype::Nullability;
 use crate::expr::BoundExpression;
 use crate::expr::Expression;
+use crate::expr::lambda::Lambda;
+use crate::expr::variable::Variable;
+use crate::higher_order_fn::EmptyOptions as HigherOrderEmptyOptions;
+use crate::higher_order_fn::HigherOrderFunctionVTableExt;
+use crate::higher_order_fn::fns::list_transform::ListTransform;
 use crate::scalar::Scalar;
 use crate::scalar::ScalarValue;
 use crate::scalar_fn::EmptyOptions;
@@ -59,7 +64,7 @@ use crate::scalar_fn::fns::zip::Zip;
 
 /// Creates an expression that references the root scope.
 ///
-/// Returns the entire input array as passed to the expression evaluator.
+/// Returns the entire input array as passed to the expression application context.
 /// This is commonly used as the starting point for field access and other operations.
 pub fn root() -> Expression {
     Expression::Root
@@ -70,6 +75,33 @@ pub fn bound_root(dtype: DType) -> BoundExpression {
     BoundExpression::new_root(dtype)
 }
 
+/// Creates an expression referencing the value bound to `name` in the surrounding lexical scope.
+pub fn var(name: impl AsRef<str>) -> Expression {
+    Variable::new(name).into()
+}
+
+/// Creates standalone lambda syntax binding `params` over `body`.
+///
+/// Returns an error when a parameter name is repeated in the same lambda.
+pub fn lambda(
+    params: impl IntoIterator<Item = impl Into<Variable>>,
+    body: Expression,
+) -> VortexResult<Expression> {
+    Ok(Expression::Lambda(Lambda::try_new(params, body)?))
+}
+
+/// Transform every element in a list with a single-parameter `lambda`.
+///
+/// The lambda is syntax rather than an ordinary expression child: its parameter type comes from
+/// the input list's element type when the expression is bound.
+pub fn list_transform(input: Expression, lambda: Expression) -> VortexResult<Expression> {
+    Expression::try_new_higher_order(
+        ListTransform.bind(HigherOrderEmptyOptions),
+        [input],
+        [lambda],
+    )
+}
+
 /// Return whether the expression is a root expression.
 pub fn is_root(expr: &Expression) -> bool {
     expr.is_root()
diff --git a/vortex-array/src/expr/lambda.rs b/vortex-array/src/expr/lambda.rs
new file mode 100644
index 00000000000..165e0014f49
--- /dev/null
+++ b/vortex-array/src/expr/lambda.rs
@@ -0,0 +1,95 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: Copyright the Vortex contributors
+
+use std::fmt;
+use std::fmt::Display;
+use std::fmt::Formatter;
+use std::sync::Arc;
+
+use itertools::Itertools;
+use vortex_error::VortexResult;
+use vortex_error::vortex_bail;
+use vortex_utils::aliases::hash_set::HashSet;
+
+use crate::expr::Expression;
+use crate::expr::variable::Variable;
+
+/// An expression `body` evaluated with named bindings `params`.
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub struct Lambda {
+    params: Arc<Vec<Variable>>,
+    body: Arc<Expression>,
+}
+
+impl Lambda {
+    /// Create a lambda binding `params` over `body`.
+    ///
+    /// Returns an error when a parameter name is repeated.
+    pub fn try_new(
+        params: impl IntoIterator<Item = impl Into<Variable>>,
+        body: Expression,
+    ) -> VortexResult<Self> {
+        let mut vars = Vec::new();
+        let mut seen = HashSet::new();
+
+        for param in params {
+            let var: Variable = param.into();
+            if !seen.insert(var.clone()) {
+                vortex_bail!("duplicate parameter");
+            }
+
+            vars.push(var)
+        }
+
+        Ok(Self {
+            params: Arc::new(vars),
+            body: Arc::new(body),
+        })
+    }
+
+    /// The variables this lambda binds, in declaration order.
+    pub fn params(&self) -> &[Variable] {
+        &self.params
+    }
+
+    /// The expression evaluated under the parameter bindings.
+    pub fn body(&self) -> &Expression {
+        &self.body
+    }
+
+    /// Replace this lambda's body while retaining its parameter declarations.
+    pub(crate) fn with_body(self, body: Expression) -> Self {
+        Self {
+            params: self.params,
+            body: Arc::new(body),
+        }
+    }
+
+    /// Take the body when this lambda is its sole owner.
+    ///
+    /// This is used by expression's iterative drop implementation so a chain of binder bodies
+    /// cannot overflow the stack while it is being released.
+    pub(crate) fn take_body(&mut self) -> Option<Expression> {
+        Arc::try_unwrap(std::mem::replace(
+            &mut self.body,
+            Arc::new(Expression::Root),
+        ))
+        .ok()
+    }
+}
+
+impl Display for Lambda {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        write!(f, "({}) -> {}", self.params.iter().join(", "), self.body)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn duplicate_parameters_are_rejected() {
+        assert!(Lambda::try_new(["x", "x"], Expression::Root).is_err());
+    }
+}
diff --git a/vortex-array/src/expr/mod.rs b/vortex-array/src/expr/mod.rs
index fb2fbf9b478..0d0372ffa6d 100644
--- a/vortex-array/src/expr/mod.rs
+++ b/vortex-array/src/expr/mod.rs
@@ -62,12 +62,14 @@ pub(crate) mod expression;
 mod exprs;
 pub(crate) mod field;
 pub mod forms;
+pub mod lambda;
 mod optimize;
 pub mod proto;
 pub mod scope;
 pub mod stats;
 pub mod transform;
 pub mod traversal;
+pub mod variable;
 
 pub use analysis::*;
 pub use bound_expression::*;
@@ -77,6 +79,7 @@ pub use exprs::and_collect;
 pub use exprs::between;
 pub use exprs::binary;
 pub use exprs::bound;
+pub use exprs::bound_root;
 pub use exprs::byte_length;
 pub use exprs::case_when;
 pub use exprs::case_when_no_else;
@@ -95,11 +98,13 @@ pub use exprs::ilike;
 pub use exprs::is_not_null;
 pub use exprs::is_null;
 pub use exprs::is_root;
+pub use exprs::lambda;
 pub use exprs::like;
 pub use exprs::list_contains;
 pub use exprs::list_length;
 pub use exprs::list_sum;
 pub use exprs::list_sum_opts;
+pub use exprs::list_transform;
 pub use exprs::lit;
 pub use exprs::lt;
 pub use exprs::lt_eq;
@@ -118,9 +123,12 @@ pub use exprs::root;
 pub use exprs::select;
 pub use exprs::select_exclude;
 pub use exprs::union_child_validities;
+pub use exprs::var;
 pub use exprs::variant_get;
 pub use exprs::zip_expr;
+pub use lambda::*;
 pub use scope::*;
+pub use variable::*;
 
 pub trait VortexExprExt {
     /// Accumulate all field references from this expression and its children in a set
@@ -163,6 +171,8 @@ impl PartialEq for ExactExpr {
     fn eq(&self, other: &Self) -> bool {
         match (&self.0, &other.0) {
             (Expression::Root, Expression::Root) => true,
+            (Expression::Variable(lhs), Expression::Variable(rhs)) => lhs == rhs,
+            (Expression::Lambda(lhs), Expression::Lambda(rhs)) => lhs == rhs,
             (
                 Expression::Scalar {
                     scalar_fn: lhs_fn,
@@ -173,6 +183,22 @@ impl PartialEq for ExactExpr {
                     children: rhs_children,
                 },
             ) => lhs_fn == rhs_fn && Arc::ptr_eq(lhs_children, rhs_children),
+            (
+                Expression::HigherOrder {
+                    higher_order_fn: lhs_fn,
+                    children: lhs_children,
+                    lambdas: lhs_lambdas,
+                },
+                Expression::HigherOrder {
+                    higher_order_fn: rhs_fn,
+                    children: rhs_children,
+                    lambdas: rhs_lambdas,
+                },
+            ) => {
+                lhs_fn == rhs_fn
+                    && Arc::ptr_eq(lhs_children, rhs_children)
+                    && Arc::ptr_eq(lhs_lambdas, rhs_lambdas)
+            }
             _ => false,
         }
     }
@@ -183,6 +209,14 @@ impl Hash for ExactExpr {
     fn hash<H: Hasher>(&self, state: &mut H) {
         match &self.0 {
             Expression::Root => state.write_u8(0),
+            Expression::Variable(variable) => {
+                state.write_u8(2);
+                variable.hash(state);
+            }
+            Expression::Lambda(lambda) => {
+                state.write_u8(3);
+                lambda.hash(state);
+            }
             Expression::Scalar {
                 scalar_fn,
                 children,
@@ -191,6 +225,16 @@ impl Hash for ExactExpr {
                 scalar_fn.hash(state);
                 Arc::as_ptr(children).hash(state);
             }
+            Expression::HigherOrder {
+                higher_order_fn,
+                children,
+                lambdas,
+            } => {
+                state.write_u8(4);
+                higher_order_fn.hash(state);
+                Arc::as_ptr(children).hash(state);
+                Arc::as_ptr(lambdas).hash(state);
+            }
         }
     }
 }
@@ -227,6 +271,7 @@ mod tests {
     use vortex_array::expr::eq;
     use vortex_array::expr::lit;
     use vortex_array::expr::root;
+    use vortex_error::VortexResult;
 
     use super::*;
     use crate::dtype::DType;
@@ -235,8 +280,6 @@ mod tests {
     use crate::dtype::PType;
     use crate::dtype::StructFields;
     use crate::expr::and;
-    use crate::expr::bound;
-    use crate::expr::case_when;
     use crate::expr::col;
     use crate::expr::get_item;
     use crate::expr::gt;
@@ -286,7 +329,7 @@ mod tests {
     }
 
     #[test]
-    fn bound_constructors_preserve_order_and_types() -> vortex_error::VortexResult<()> {
+    fn bound_constructors_preserve_order_and_types() -> VortexResult<()> {
         let value_dtype = DType::Primitive(PType::I32, Nullability::NonNullable);
         let scope = DType::Struct(
             StructFields::from_iter([("value", value_dtype.clone())]),
@@ -326,9 +369,14 @@ mod tests {
     }
 
     #[test]
-    fn expr_display() {
+    fn expr_display() -> VortexResult<()> {
         assert_eq!(col("a").to_string(), "$.a");
         assert_eq!(root().to_string(), "$");
+        assert_eq!(var("value").to_string(), "$value");
+        assert_eq!(
+            lambda(["left", "right"], var("left"))?.to_string(),
+            "(left, right) -> $left"
+        );
 
         let col1: Expression = col("col1");
         let col2: Expression = col("col2");
@@ -422,6 +470,7 @@ mod tests {
             .to_string(),
             "{dog: 32u32, cat: \"rufus\"}"
         );
+        Ok(())
     }
 
     #[test]
diff --git a/vortex-array/src/expr/optimize.rs b/vortex-array/src/expr/optimize.rs
index 3e625324a18..b36d014fad7 100644
--- a/vortex-array/src/expr/optimize.rs
+++ b/vortex-array/src/expr/optimize.rs
@@ -5,11 +5,13 @@ use std::cell::RefCell;
 
 use itertools::Itertools;
 use vortex_error::VortexResult;
+use vortex_error::vortex_ensure;
 use vortex_error::vortex_err;
 use vortex_utils::aliases::hash_map::HashMap;
 
 use crate::dtype::DType;
 use crate::expr::Expression;
+use crate::expr::Scope;
 use crate::expr::transform::match_between::find_between;
 use crate::scalar_fn::ExpressionReduceNode;
 use crate::scalar_fn::SimplifyCtx;
@@ -22,6 +24,11 @@ impl Expression {
     /// 2. `simplify` - type-aware simplifications
     /// 3. `reduce` - abstract reduction rules via `ReduceNode`
     pub fn optimize(&self, scope: &DType) -> VortexResult<Expression> {
+        self.optimize_scope(&Scope::new(scope.clone()))
+    }
+
+    /// Optimize the root expression node against a lexical scope.
+    pub fn optimize_scope(&self, scope: &Scope) -> VortexResult<Expression> {
         let cache = SimplifyCache::new(scope);
         Ok(self.try_optimize(&cache)?.unwrap_or_else(|| self.clone()))
     }
@@ -32,7 +39,7 @@ impl Expression {
     fn simplify_untyped_node(&self) -> VortexResult<Option<Expression>> {
         match self {
             Expression::Scalar { scalar_fn, .. } => scalar_fn.simplify_untyped(self),
-            Expression::Root => Ok(None),
+            _ => Ok(None),
         }
     }
 
@@ -40,7 +47,7 @@ impl Expression {
     fn simplify_node(&self, ctx: &dyn SimplifyCtx) -> VortexResult<Option<Expression>> {
         match self {
             Expression::Scalar { scalar_fn, .. } => scalar_fn.simplify(self, ctx),
-            Expression::Root => Ok(None),
+            _ => Ok(None),
         }
     }
 
@@ -51,7 +58,7 @@ impl Expression {
     ) -> VortexResult<Option<ExpressionReduceNode<'a>>> {
         match self {
             Expression::Scalar { scalar_fn, .. } => scalar_fn.reduce_expression(node),
-            Expression::Root => Ok(None),
+            _ => Ok(None),
         }
     }
 
@@ -90,7 +97,7 @@ impl Expression {
             // constructing it is free; the block scopes the borrows so `current` can be updated.
             let reduced = {
                 let expr = current.as_ref().unwrap_or(self);
-                let reduce_node = ExpressionReduceNode::new(expr, cache.scope);
+                let reduce_node = ExpressionReduceNode::new(expr, cache.scope.root());
                 expr.reduce_node(&reduce_node)?
                     .map(ExpressionReduceNode::into_expression)
             };
@@ -111,14 +118,28 @@ impl Expression {
     ///
     /// Optimizes children first (bottom-up), then optimizes the root.
     pub fn optimize_recursive(&self, scope: &DType) -> VortexResult<Expression> {
+        self.optimize_recursive_scope(&Scope::new(scope.clone()))
+    }
+
+    /// Optimize the entire expression tree recursively against a lexical scope.
+    ///
+    /// Variables are resolved from `scope` during type-aware simplification. Higher-order
+    /// functions establish a child scope for each lambda body, so the body is optimized under its
+    /// own root dtype and parameter frame while keeping enclosing captures available.
+    pub fn optimize_recursive_scope(&self, scope: &Scope) -> VortexResult<Expression> {
         Ok(self
             .clone()
-            .try_optimize_recursive(scope)?
+            .try_optimize_recursive_scope(scope)?
             .unwrap_or_else(|| self.clone()))
     }
 
     /// Try to optimize the entire expression tree recursively.
     pub fn try_optimize_recursive(&self, scope: &DType) -> VortexResult<Option<Expression>> {
+        self.try_optimize_recursive_scope(&Scope::new(scope.clone()))
+    }
+
+    /// Try to optimize the entire expression tree recursively against a lexical scope.
+    pub fn try_optimize_recursive_scope(&self, scope: &Scope) -> VortexResult<Option<Expression>> {
         let cache = SimplifyCache::new(scope);
         let result = self.try_optimize_recursive_inner(&cache)?;
 
@@ -157,17 +178,72 @@ impl Expression {
             current = Some(updated.try_optimize(cache)?.unwrap_or(updated));
         }
 
+        // Lambda bodies are binder-owned syntax rather than ordinary row-domain children. Walk
+        // them explicitly with the signature-derived lexical scope so captures and nested lambda
+        // shadowing keep their original meaning.
+        let expr = current.as_ref().unwrap_or(self);
+        if let Expression::HigherOrder {
+            higher_order_fn,
+            children,
+            lambdas,
+        } = expr
+        {
+            let arg_dtypes: Vec<DType> = children
+                .iter()
+                .map(|child| child.return_dtype_scope(cache.scope))
+                .try_collect()?;
+            let lambda_syntax = lambdas
+                .iter()
+                .map(|lambda| {
+                    lambda.as_lambda().ok_or_else(|| {
+                        vortex_err!(
+                            "higher-order expression '{}' contained a non-lambda argument",
+                            higher_order_fn.id()
+                        )
+                    })
+                })
+                .collect::<VortexResult<Vec<_>>>()?;
+            let signatures = higher_order_fn.lambda_signatures(&arg_dtypes, &lambda_syntax)?;
+            vortex_ensure!(
+                signatures.len() == lambda_syntax.len(),
+                "higher-order function '{}' produced {} lambda signatures for {} lambda arguments",
+                higher_order_fn.id(),
+                signatures.len(),
+                lambda_syntax.len(),
+            );
+
+            let mut new_lambdas: Option<Vec<Expression>> = None;
+            for (index, (lambda, signature)) in
+                lambda_syntax.iter().zip(signatures.iter()).enumerate()
+            {
+                let lambda_scope = signature.scope(lambda, cache.scope)?;
+                let lambda_cache = SimplifyCache::new(&lambda_scope);
+                if let Some(body) = lambda.body().try_optimize_recursive_inner(&lambda_cache)? {
+                    new_lambdas
+                        .get_or_insert_with(|| lambdas[..index].to_vec())
+                        .push(Expression::Lambda((*lambda).clone().with_body(body)));
+                } else if let Some(new_lambdas) = new_lambdas.as_mut() {
+                    new_lambdas.push(lambdas[index].clone());
+                }
+            }
+
+            if let Some(new_lambdas) = new_lambdas {
+                let updated = expr.clone().with_lambdas(new_lambdas)?;
+                current = Some(updated.try_optimize(cache)?.unwrap_or(updated));
+            }
+        }
+
         Ok(current)
     }
 }
 
 struct SimplifyCache<'a> {
-    scope: &'a DType,
+    scope: &'a Scope,
     dtype_cache: RefCell<HashMap<Expression, DType>>,
 }
 
 impl<'a> SimplifyCache<'a> {
-    fn new(scope: &'a DType) -> Self {
+    fn new(scope: &'a Scope) -> Self {
         Self {
             scope,
             dtype_cache: RefCell::new(HashMap::new()),
@@ -179,23 +255,40 @@ impl SimplifyCtx for SimplifyCache<'_> {
     fn return_dtype(&self, expr: &Expression) -> VortexResult<DType> {
         // If the expression is "root", return the scope dtype
         if expr.is_root() {
-            return Ok(self.scope.clone());
+            return Ok(self.scope.root().clone());
+        }
+
+        if let Some(variable) = expr.as_variable() {
+            return self
+                .scope
+                .resolve(variable)
+                .map(|(dtype, _)| dtype.clone())
+                .ok_or_else(|| vortex_err!("unbound variable '{variable}'"));
         }
 
         if let Some(dtype) = self.dtype_cache.borrow().get(expr) {
             return Ok(dtype.clone());
         }
 
-        // Otherwise, compute dtype from children
-        let input_dtypes: Vec<_> = expr
-            .children()
-            .iter()
-            .map(|c| self.return_dtype(c))
-            .try_collect()?;
-        let dtype = expr
-            .as_scalar()
-            .ok_or_else(|| vortex_err!("cannot type a non-scalar expression: {expr}"))?
-            .return_dtype(&input_dtypes)?;
+        let dtype = match expr {
+            Expression::Scalar { scalar_fn, .. } => {
+                let input_dtypes: Vec<_> = expr
+                    .children()
+                    .iter()
+                    .map(|child| self.return_dtype(child))
+                    .try_collect()?;
+                scalar_fn.return_dtype(&input_dtypes)?
+            }
+            // Binding derives the higher-order function's lambda parameter scopes before asking
+            // it for the result dtype; a generic scalar-only calculation cannot do that.
+            Expression::HigherOrder { .. } => expr.return_dtype_scope(self.scope)?,
+            Expression::Lambda(_) => {
+                return Err(vortex_err!(
+                    "a lambda has no standalone return dtype; it must be bound by a higher-order function"
+                ));
+            }
+            Expression::Root | Expression::Variable(_) => unreachable!("handled above"),
+        };
         self.dtype_cache
             .borrow_mut()
             .insert(expr.clone(), dtype.clone());
@@ -206,6 +299,7 @@ impl SimplifyCtx for SimplifyCache<'_> {
 
 #[cfg(test)]
 mod tests {
+    use vortex_error::VortexExpect;
     use vortex_error::VortexResult;
     use vortex_error::vortex_err;
 
@@ -213,13 +307,21 @@ mod tests {
     use crate::dtype::Nullability;
     use crate::dtype::PType;
     use crate::dtype::StructFields;
+    use crate::expr::Scope;
+    use crate::expr::Variable;
     use crate::expr::cast;
+    use crate::expr::checked_add;
+    use crate::expr::col;
     use crate::expr::eq;
     use crate::expr::get_item;
+    use crate::expr::lambda;
+    use crate::expr::list_transform;
     use crate::expr::lit;
     use crate::expr::lt_eq;
     use crate::expr::or;
     use crate::expr::root;
+    use crate::expr::test_harness::struct_dtype;
+    use crate::expr::var;
     use crate::scalar::Scalar;
     use crate::scalar_fn::fns::literal::Literal;
 
@@ -272,4 +374,62 @@ mod tests {
         assert_eq!(rhs, &Scalar::primitive(3.0f64, Nullability::NonNullable));
         Ok(())
     }
+
+    #[test]
+    fn optimization_folds_a_literal_cast() -> VortexResult<()> {
+        let expr = lt_eq(
+            col("a"),
+            cast(
+                lit(3_i32),
+                DType::Primitive(PType::I64, Nullability::NonNullable),
+            ),
+        );
+        let optimized = expr.optimize_recursive(&struct_dtype())?;
+        assert_ne!(optimized, expr, "casting a literal should fold");
+        Ok(())
+    }
+
+    #[test]
+    fn optimization_resolves_variables_from_a_lexical_scope() -> VortexResult<()> {
+        let scope = Scope::new(DType::Null).with_bindings([(
+            Variable::new("value"),
+            DType::Primitive(PType::I32, Nullability::NonNullable),
+        )])?;
+        let expression = eq(var("value"), lit(42_i32));
+
+        let optimized = expression.optimize_recursive_scope(&scope)?;
+        assert_eq!(optimized, expression);
+        Ok(())
+    }
+
+    #[test]
+    fn optimization_enters_nested_lambda_scopes() -> VortexResult<()> {
+        let i64_dtype = DType::Primitive(PType::I64, Nullability::NonNullable);
+        let inner = list_transform(
+            var("outer"),
+            lambda(
+                ["inner"],
+                checked_add(var("inner"), cast(lit(1_i32), i64_dtype.clone())),
+            )?,
+        )?;
+        let expression = list_transform(root(), lambda(["outer"], inner)?)?;
+        let scope = DType::List(
+            DType::List(i64_dtype.into(), Nullability::NonNullable).into(),
+            Nullability::NonNullable,
+        );
+
+        let optimized = expression.optimize_recursive(&scope)?;
+        let outer = optimized.lambdas()[0]
+            .as_lambda()
+            .vortex_expect("outer lambda syntax");
+        let inner = outer.body();
+        let inner = inner.lambdas()[0]
+            .as_lambda()
+            .vortex_expect("inner lambda syntax");
+        assert!(
+            inner.body().child(1).is::<Literal>(),
+            "the inner lambda should fold its literal cast: {optimized}"
+        );
+        Ok(())
+    }
 }
diff --git a/vortex-array/src/expr/proto.rs b/vortex-array/src/expr/proto.rs
index 4f544fecafb..bdafd46c90b 100644
--- a/vortex-array/src/expr/proto.rs
+++ b/vortex-array/src/expr/proto.rs
@@ -2,6 +2,7 @@
 // SPDX-FileCopyrightText: Copyright the Vortex contributors
 
 use itertools::Itertools;
+use prost::Message;
 use vortex_error::VortexResult;
 use vortex_error::vortex_ensure;
 use vortex_error::vortex_err;
@@ -9,6 +10,10 @@ use vortex_proto::expr as pb;
 use vortex_session::VortexSession;
 
 use crate::expr::Expression;
+use crate::expr::Lambda;
+use crate::expr::Variable;
+use crate::higher_order_fn::HigherOrderFunctionId;
+use crate::higher_order_fn::session::HigherOrderFunctionSessionExt;
 use crate::scalar_fn::ForeignScalarFnVTable;
 use crate::scalar_fn::ScalarFnId;
 use crate::scalar_fn::session::ScalarFnSessionExt;
@@ -18,18 +23,105 @@ pub trait ExprSerializeProtoExt {
     fn serialize_proto(&self) -> VortexResult<pb::Expr>;
 }
 
-/// The wire id for [`Expression::Root`], retained from when `Root` was a scalar function so that
-/// already-serialized expressions keep round-tripping.
+/// The wire id for [`Expression::Root`].
 pub(crate) const ROOT_ID: &str = "vortex.root";
 
+/// The wire id for [`Expression::Variable`].
+pub(crate) const VARIABLE_ID: &str = "vortex.var";
+
+/// The wire id for [`Expression::Lambda`].
+pub(crate) const LAMBDA_ID: &str = "vortex.lambda";
+
+pub trait LambdaSerializeProtoExt {
+    fn serialize_proto(&self) -> VortexResult<pb::Expr>;
+}
+
+impl LambdaSerializeProtoExt for Lambda {
+    fn serialize_proto(&self) -> VortexResult<pb::Expr> {
+        Ok(pb::Expr {
+            id: LAMBDA_ID.to_string(),
+            children: vec![self.body().serialize_proto()?],
+            metadata: Some(
+                pb::LambdaOpts {
+                    params: self
+                        .params()
+                        .iter()
+                        .map(|variable| variable.name().to_string())
+                        .collect(),
+                }
+                .encode_to_vec(),
+            ),
+        })
+    }
+}
+
+impl Lambda {
+    pub fn from_proto(expr: &pb::Expr, session: &VortexSession) -> VortexResult<Self> {
+        vortex_ensure!(
+            expr.id == LAMBDA_ID,
+            "expected lambda expression id '{LAMBDA_ID}', got '{}'",
+            expr.id
+        );
+        vortex_ensure!(
+            expr.children.len() == 1,
+            "a lambda must have exactly one child, its body, got {}",
+            expr.children.len()
+        );
+        let opts = pb::LambdaOpts::decode(expr.metadata())?;
+        Self::try_new(
+            opts.params.into_iter().map(Variable::new),
+            Expression::from_proto(&expr.children[0], session)?,
+        )
+    }
+}
+
 impl ExprSerializeProtoExt for Expression {
     fn serialize_proto(&self) -> VortexResult<pb::Expr> {
-        let Some(scalar_fn) = self.as_scalar() else {
-            return Ok(pb::Expr {
-                id: ROOT_ID.to_string(),
-                children: vec![],
-                metadata: Some(vec![]),
-            });
+        let scalar_fn = match self {
+            Expression::Lambda(lambda) => return lambda.serialize_proto(),
+            Expression::Root => {
+                return Ok(pb::Expr {
+                    id: ROOT_ID.to_string(),
+                    children: vec![],
+                    metadata: Some(vec![]),
+                });
+            }
+            Expression::Variable(variable) => {
+                return Ok(pb::Expr {
+                    id: VARIABLE_ID.to_string(),
+                    children: vec![],
+                    metadata: Some(
+                        pb::VariableOpts {
+                            name: variable.name().to_string(),
+                        }
+                        .encode_to_vec(),
+                    ),
+                });
+            }
+            Expression::HigherOrder {
+                higher_order_fn,
+                children,
+                lambdas,
+            } => {
+                let children = children
+                    .iter()
+                    .map(ExprSerializeProtoExt::serialize_proto)
+                    .chain(lambdas.iter().map(ExprSerializeProtoExt::serialize_proto))
+                    .collect::<VortexResult<Vec<_>>>()?;
+                let metadata = higher_order_fn.serialize()?.ok_or_else(|| {
+                    vortex_err!(
+                        "Expression '{}' is not serializable: {}",
+                        higher_order_fn.id(),
+                        self
+                    )
+                })?;
+                return Ok(pb::Expr {
+                    id: higher_order_fn.id().to_string(),
+                    children,
+                    metadata: Some(metadata),
+                });
+            }
+            Expression::Scalar { scalar_fn, .. } => scalar_fn,
         };
 
         let children = self
@@ -56,7 +148,8 @@ impl ExprSerializeProtoExt for Expression {
 
 impl Expression {
     pub fn from_proto(expr: &pb::Expr, session: &VortexSession) -> VortexResult<Expression> {
-        // Root is not a registered scalar fn, so it must be resolved before the registry lookup.
+        // These are language primitives rather than registered scalar fns, so they must be
+        // resolved before the registry lookup below.
         if expr.id == ROOT_ID {
             vortex_ensure!(
                 expr.children.is_empty(),
@@ -66,6 +159,53 @@ impl Expression {
             return Ok(Expression::Root);
         }
 
+        if expr.id == VARIABLE_ID {
+            vortex_ensure!(
+                expr.children.is_empty(),
+                "a variable must have no children, got {}",
+                expr.children.len()
+            );
+            let opts = pb::VariableOpts::decode(expr.metadata())?;
+            return Ok(Expression::Variable(Variable::new(opts.name)));
+        }
+
+        if expr.id == LAMBDA_ID {
+            return Ok(Expression::Lambda(Lambda::from_proto(expr, session)?));
+        }
+
+        #[expect(clippy::disallowed_methods, reason = "interning a dynamic id")]
+        let higher_order_id = HigherOrderFunctionId::new(expr.id.as_str());
+        if let Some(plugin) = session
+            .higher_order_functions()
+            .registry()
+            .get(&higher_order_id)
+        {
+            let higher_order_fn = plugin.deserialize(expr.metadata(), session)?;
+            vortex_ensure!(
+                expr.children.len() >= higher_order_fn.lambda_arity(),
+                "higher-order expression '{}' has too few children for {} lambdas",
+                higher_order_fn.id(),
+                higher_order_fn.lambda_arity()
+            );
+            let ordinary_children = expr.children.len() - higher_order_fn.lambda_arity();
+            vortex_ensure!(
+                higher_order_fn.arity().matches(ordinary_children),
+                "higher-order expression '{}' expected {} ordinary children, got {}",
+                higher_order_fn.id(),
+                higher_order_fn.arity(),
+                ordinary_children
+            );
+            let children = expr.children[..ordinary_children]
+                .iter()
+                .map(|child| Expression::from_proto(child, session))
+                .collect::<VortexResult<Vec<_>>>()?;
+            let lambdas = expr.children[ordinary_children..]
+                .iter()
+                .map(|child| Expression::from_proto(child, session))
+                .collect::<VortexResult<Vec<_>>>()?;
+            return Expression::try_new_higher_order(higher_order_fn, children, lambdas);
+        }
+
         #[expect(clippy::disallowed_methods, reason = "interning a dynamic id")]
         let expr_id = ScalarFnId::new(expr.id.as_str());
         let children = expr
@@ -141,6 +281,23 @@ mod tests {
         assert_eq!(&deser_expr, &expr);
     }
 
+    /// A lambda carries its body as a child, so a malformed message must be rejected rather than
+    /// silently producing a lambda with the wrong arity.
+    #[test]
+    fn a_lambda_without_a_body_is_rejected() {
+        let malformed = pb::Expr {
+            id: "vortex.lambda".to_string(),
+            children: vec![],
+            metadata: Some(
+                pb::LambdaOpts {
+                    params: vec!["x".to_string()],
+                }
+                .encode_to_vec(),
+            ),
+        };
+        assert!(Expression::from_proto(&malformed, &array_session()).is_err());
+    }
+
     #[test]
     fn unknown_expression_id_allow_unknown() {
         let session = VortexSession::empty().with::<ScalarFnSession>();
diff --git a/vortex-array/src/expr/scope.rs b/vortex-array/src/expr/scope.rs
index 04de3202cf5..f42d8db94f2 100644
--- a/vortex-array/src/expr/scope.rs
+++ b/vortex-array/src/expr/scope.rs
@@ -1,28 +1,171 @@
 // SPDX-License-Identifier: Apache-2.0
 // SPDX-FileCopyrightText: Copyright the Vortex contributors
 
+use std::sync::Arc;
+
+use vortex_error::VortexResult;
+use vortex_error::vortex_bail;
+use vortex_utils::aliases::hash_set::HashSet;
+
 use crate::dtype::DType;
+use crate::expr::variable::Variable;
+
+/// A stable location for a variable resolved in a lexical [`Scope`].
+///
+/// Frames are indexed from the outermost binding and slots are indexed in declaration order.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub struct VariableRef {
+    frame: usize,
+    slot: usize,
+}
+
+impl VariableRef {
+    fn new(frame: usize, slot: usize) -> Self {
+        Self { frame, slot }
+    }
+
+    /// The lexical frame containing this binding, counted from the outermost frame.
+    pub fn frame(&self) -> usize {
+        self.frame
+    }
+
+    /// The binding's position in its frame, in declaration order.
+    pub fn slot(&self) -> usize {
+        self.slot
+    }
+}
+
+/// A set of named bindings introduced by a single binder.
+///
+/// A lambda pushes exactly one frame, holding its parameters. Names within a frame must be unique;
+/// a name in an inner frame shadows the same name in an outer one.
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub struct Frame(Arc<Vec<(Variable, DType)>>);
+
+impl Frame {
+    /// Create a frame from its bindings, in declaration order.
+    ///
+    /// Errors if a name is bound more than once, since a reference to it would be ambiguous.
+    pub fn try_new(bindings: impl IntoIterator<Item = (Variable, DType)>) -> VortexResult<Self> {
+        let mut seen = HashSet::new();
+        let mut frame = Vec::new();
+        for (variable, dtype) in bindings {
+            if !seen.insert(variable.clone()) {
+                vortex_bail!("duplicate binding in a single frame");
+            }
+
+            frame.push((variable, dtype));
+        }
+
+        Ok(Self(Arc::new(frame)))
+    }
+
+    /// The bindings in this frame, in declaration order.
+    pub fn bindings(&self) -> &[(Variable, DType)] {
+        &self.0
+    }
+
+    /// The dtype and declaration slot bound to `name` in this frame, if any.
+    fn get(&self, name: &Variable) -> Option<(&DType, usize)> {
+        self.0
+            .iter()
+            .enumerate()
+            .find_map(|(slot, (bound, dtype))| (bound == name).then_some((dtype, slot)))
+    }
+}
 
 /// The context an [`Expression`](crate::expr::Expression) is bound against.
 ///
-/// Today a scope is just the dtype that [`root`](crate::expr::root) resolves to. It is an opaque
-/// struct rather than a bare [`DType`] so that lexical bindings can be added later without changing
-/// [`Expression::bind_scope`](crate::expr::Expression::bind_scope)'s signature.
+/// A scope is the dtype that [`root`](crate::expr::root) resolves to, plus a stack of [`Frame`]s
+/// holding named bindings. The stack resolves names lexically, including inner-frame shadowing.
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct Scope {
     root: DType,
+    /// Innermost frame last.
+    frames: Vec<Frame>,
 }
 
 impl Scope {
-    /// Create a scope in which `root` resolves to the given dtype.
+    /// Create a scope in which `root` resolves to the given dtype, with no bindings.
     pub fn new(root: DType) -> Self {
-        Self { root }
+        Self {
+            root,
+            frames: Vec::new(),
+        }
     }
 
     /// The dtype that `root` resolves to.
     pub fn root(&self) -> &DType {
         &self.root
     }
+
+    /// The number of enclosing binders.
+    pub fn depth(&self) -> usize {
+        self.frames.len()
+    }
+
+    /// Return this scope extended with one more frame, which becomes the innermost.
+    pub fn push_frame(&self, frame: Frame) -> Self {
+        let mut frames = self.frames.clone();
+        frames.push(frame);
+        Self {
+            root: self.root.clone(),
+            frames,
+        }
+    }
+
+    /// Add a named binding to this scope's current frame.
+    ///
+    /// Prefer [`Self::push_frame`] for a lexical binder. This mutating helper is retained for
+    /// callers constructing one frame incrementally.
+    pub fn bind(&mut self, variable: Variable, dtype: DType) -> VortexResult<()> {
+        if self.frames.is_empty() {
+            self.frames.push(Frame(Arc::new(Vec::new())));
+        }
+        let Some(frame) = self.frames.last_mut() else {
+            unreachable!("a frame was inserted above")
+        };
+        let bindings = Arc::make_mut(&mut frame.0);
+        if bindings.iter().any(|(bound, _)| bound == &variable) {
+            vortex_bail!("variable '{variable}' is already bound in the current frame");
+        }
+        bindings.push((variable, dtype));
+        Ok(())
+    }
+
+    /// Return this scope extended with one frame containing `bindings`.
+    pub fn with_bindings(
+        self,
+        bindings: impl IntoIterator<Item = (Variable, DType)>,
+    ) -> VortexResult<Self> {
+        Ok(self.push_frame(Frame::try_new(bindings)?))
+    }
+
+    /// Return this scope with the same lexical frames and a different `root` dtype.
+    ///
+    /// A higher-order function uses this when its lambda body has a new implicit input while
+    /// retaining access to surrounding lambda frames.
+    pub fn with_root(&self, root: DType) -> Self {
+        Self {
+            root,
+            frames: self.frames.clone(),
+        }
+    }
+
+    /// Resolve `name`, searching innermost-first so that inner bindings shadow outer ones.
+    ///
+    /// Returns the bound dtype and stable lexical location of `name`.
+    pub fn resolve(&self, name: &Variable) -> Option<(&DType, VariableRef)> {
+        self.frames
+            .iter()
+            .enumerate()
+            .rev()
+            .find_map(|(frame, bindings)| {
+                bindings
+                    .get(name)
+                    .map(|(dtype, slot)| (dtype, VariableRef::new(frame, slot)))
+            })
+    }
 }
 
 impl From<DType> for Scope {
@@ -33,8 +176,19 @@ impl From<DType> for Scope {
 
 #[cfg(test)]
 mod tests {
+    use vortex_error::VortexResult;
+
     use super::*;
     use crate::dtype::Nullability;
+    use crate::dtype::PType;
+
+    fn i32_() -> DType {
+        DType::Primitive(PType::I32, Nullability::NonNullable)
+    }
+
+    fn utf8() -> DType {
+        DType::Utf8(Nullability::NonNullable)
+    }
 
     #[test]
     fn root_round_trips() {
@@ -42,4 +196,63 @@ mod tests {
         assert_eq!(Scope::new(dtype.clone()).root(), &dtype);
         assert_eq!(Scope::from(dtype.clone()).root(), &dtype);
     }
+
+    #[test]
+    fn an_empty_scope_resolves_nothing() {
+        let scope = Scope::new(i32_());
+        assert_eq!(scope.depth(), 0);
+        assert!(scope.resolve(&Variable::new("x")).is_none());
+    }
+
+    #[test]
+    fn resolve_tracks_the_frame_and_slot() -> VortexResult<()> {
+        let scope = Scope::new(i32_())
+            .push_frame(Frame::try_new([(Variable::new("a"), i32_())])?)
+            .push_frame(Frame::try_new([
+                (Variable::new("b"), utf8()),
+                (Variable::new("c"), i32_()),
+            ])?);
+
+        assert_eq!(
+            scope.resolve(&Variable::new("a")),
+            Some((&i32_(), VariableRef::new(0, 0)))
+        );
+        assert_eq!(
+            scope.resolve(&Variable::new("b")),
+            Some((&utf8(), VariableRef::new(1, 0)))
+        );
+        assert_eq!(
+            scope.resolve(&Variable::new("c")),
+            Some((&i32_(), VariableRef::new(1, 1)))
+        );
+        assert_eq!(scope.depth(), 2);
+        Ok(())
+    }
+
+    #[test]
+    fn inner_frames_shadow_outer_ones() -> VortexResult<()> {
+        let scope = Scope::new(i32_())
+            .push_frame(Frame::try_new([(Variable::new("x"), i32_())])?)
+            .push_frame(Frame::try_new([(Variable::new("x"), utf8())])?);
+
+        assert!(scope.resolve(&Variable::new("x")) == Some((&utf8(), VariableRef::new(1, 0))));
+        Ok(())
+    }
+
+    #[test]
+    fn duplicate_names_in_one_frame_are_rejected() {
+        assert!(
+            Frame::try_new([(Variable::new("x"), i32_()), (Variable::new("x"), utf8())]).is_err()
+        );
+    }
+
+    #[test]
+    fn pushing_a_frame_does_not_mutate_the_original() -> VortexResult<()> {
+        let outer = Scope::new(i32_());
+        let inner = outer.push_frame(Frame::try_new([(Variable::new("x"), i32_())])?);
+
+        assert!(outer.resolve(&Variable::new("x")).is_none());
+        assert!(inner.resolve(&Variable::new("x")).is_some());
+        Ok(())
+    }
 }
diff --git a/vortex-array/src/expr/transform/coerce.rs b/vortex-array/src/expr/transform/coerce.rs
index 48e52b1b4a9..8f36a025736 100644
--- a/vortex-array/src/expr/transform/coerce.rs
+++ b/vortex-array/src/expr/transform/coerce.rs
@@ -4,13 +4,13 @@
 //! Expression-level type coercion pass.
 
 use vortex_error::VortexResult;
+use vortex_error::vortex_ensure;
+use vortex_error::vortex_err;
 
 use crate::dtype::DType;
 use crate::expr::Expression;
+use crate::expr::Scope;
 use crate::expr::cast;
-use crate::expr::traversal::NodeExt;
-use crate::expr::traversal::Transformed;
-use crate::scalar_fn::fns::literal::Literal;
 
 /// Rewrite an expression tree to insert casts where a scalar function's `coerce_args` demands
 /// a different type than what the child currently produces.
@@ -18,53 +18,118 @@ use crate::scalar_fn::fns::literal::Literal;
 /// The rewrite is bottom-up: children are coerced first, then each parent node checks whether
 /// its children match the coerced argument types.
 pub fn coerce_expression(expr: Expression, scope: &DType) -> VortexResult<Expression> {
-    // We capture scope by reference for the closure.
-    let scope = scope.clone();
-    expr.transform_up(|node| {
-        // Leaf nodes (Root, Literal) have no children to coerce.
-        if node.is_root() || node.is::<Literal>() || node.children().is_empty() {
-            return Ok(Transformed::no(node));
+    coerce_expression_scope(expr, &Scope::new(scope.clone()))
+}
+
+/// Rewrite an expression against a lexical scope, inserting casts demanded by scalar functions
+/// and by the ordinary inputs of higher-order functions.
+///
+/// A higher-order function's lambdas are bound only after its ordinary inputs have been coerced:
+/// those final input dtypes establish the lexical parameter scope of each lambda.
+pub fn coerce_expression_scope(expr: Expression, scope: &Scope) -> VortexResult<Expression> {
+    coerce_expression_inner(expr, scope)
+}
+
+fn coerce_expression_inner(expr: Expression, scope: &Scope) -> VortexResult<Expression> {
+    match &expr {
+        Expression::Root | Expression::Variable(_) | Expression::Lambda(_) => Ok(expr),
+        Expression::Scalar {
+            scalar_fn,
+            children,
+        } => {
+            let children = children
+                .iter()
+                .cloned()
+                .map(|child| coerce_expression_inner(child, scope))
+                .collect::<VortexResult<Vec<_>>>()?;
+            let children =
+                coerce_children(children, scope, |dtypes| scalar_fn.coerce_args(dtypes))?;
+            Expression::try_new(scalar_fn.clone(), children)
         }
+        Expression::HigherOrder {
+            higher_order_fn,
+            children,
+            lambdas,
+        } => {
+            let children = children
+                .iter()
+                .cloned()
+                .map(|child| coerce_expression_inner(child, scope))
+                .collect::<VortexResult<Vec<_>>>()?;
+            let children = coerce_children(children, scope, |dtypes| {
+                higher_order_fn.coerce_input_args(dtypes)
+            })?;
 
-        // Compute the current child return types.
-        let child_dtypes: Vec<DType> = node
-            .children()
-            .iter()
-            .map(|c| c.return_dtype(&scope))
-            .collect::<VortexResult<_>>()?;
-
-        // Ask the scalar function what types it wants.
-        let Some(scalar_fn) = node.as_scalar() else {
-            return Ok(Transformed::no(node));
-        };
-        let coerced_dtypes = scalar_fn.coerce_args(&child_dtypes)?;
-
-        // If nothing changed, skip.
-        if child_dtypes == coerced_dtypes {
-            return Ok(Transformed::no(node));
+            let arg_dtypes = children
+                .iter()
+                .map(|child| child.return_dtype_scope(scope))
+                .collect::<VortexResult<Vec<_>>>()?;
+            let lambda_syntax = lambdas
+                .iter()
+                .map(|lambda| {
+                    lambda.as_lambda().ok_or_else(|| {
+                        vortex_err!(
+                            "higher-order expression '{}' contained a non-lambda argument",
+                            higher_order_fn.id()
+                        )
+                    })
+                })
+                .collect::<VortexResult<Vec<_>>>()?;
+            let signatures = higher_order_fn.lambda_signatures(&arg_dtypes, &lambda_syntax)?;
+            vortex_ensure!(
+                signatures.len() == lambda_syntax.len(),
+                "higher-order function '{}' produced {} lambda signatures for {} lambda arguments",
+                higher_order_fn.id(),
+                signatures.len(),
+                lambda_syntax.len(),
+            );
+            let lambdas = lambda_syntax
+                .into_iter()
+                .zip(signatures.iter())
+                .map(|(lambda, signature)| {
+                    let body = coerce_expression_inner(
+                        lambda.body().clone(),
+                        &signature.scope(lambda, scope)?,
+                    )?;
+                    Ok(Expression::Lambda(lambda.clone().with_body(body)))
+                })
+                .collect::<VortexResult<Vec<_>>>()?;
+
+            Expression::try_new_higher_order(higher_order_fn.clone(), children, lambdas)
         }
+    }
+}
+
+fn coerce_children(
+    children: Vec<Expression>,
+    scope: &Scope,
+    coerce: impl FnOnce(&[DType]) -> VortexResult<Vec<DType>>,
+) -> VortexResult<Vec<Expression>> {
+    let child_dtypes = children
+        .iter()
+        .map(|child| child.return_dtype_scope(scope))
+        .collect::<VortexResult<Vec<_>>>()?;
+    let coerced_dtypes = coerce(&child_dtypes)?;
+    vortex_ensure!(
+        child_dtypes.len() == coerced_dtypes.len(),
+        "argument coercion returned {} types for {} children",
+        coerced_dtypes.len(),
+        child_dtypes.len(),
+    );
 
-        // Build new children, inserting casts where needed.
-        let new_children: Vec<Expression> = node
-            .children()
-            .iter()
-            .zip(coerced_dtypes.iter())
-            .map(|(child, target)| {
-                let child_dtype = child.return_dtype(&scope)?;
-                if child_dtype.eq_ignore_nullability(target)
-                    && child_dtype.nullability() == target.nullability()
-                {
-                    Ok(child.clone())
-                } else {
-                    Ok(cast(child.clone(), target.clone()))
-                }
-            })
-            .collect::<VortexResult<_>>()?;
-
-        let new_expr = node.with_children(new_children)?;
-        Ok(Transformed::yes(new_expr))
-    })
-    .map(|t| t.into_inner())
+    children
+        .into_iter()
+        .zip(child_dtypes.into_iter().zip(coerced_dtypes))
+        .map(|(child, (child_dtype, target))| {
+            if child_dtype.eq_ignore_nullability(&target)
+                && child_dtype.nullability() == target.nullability()
+            {
+                Ok(child)
+            } else {
+                Ok(cast(child, target))
+            }
+        })
+        .collect()
 }
 
 #[cfg(test)]
diff --git a/vortex-array/src/expr/transform/partition.rs b/vortex-array/src/expr/transform/partition.rs
index 92dca145d47..eb81997bd4a 100644
--- a/vortex-array/src/expr/transform/partition.rs
+++ b/vortex-array/src/expr/transform/partition.rs
@@ -16,6 +16,7 @@ use crate::dtype::FieldNames;
 use crate::dtype::Nullability;
 use crate::dtype::StructFields;
 use crate::expr::Expression;
+use crate::expr::Scope;
 use crate::expr::analysis::Annotation;
 use crate::expr::analysis::AnnotationFn;
 use crate::expr::analysis::Annotations;
@@ -44,13 +45,29 @@ pub fn partition<A: AnnotationFn>(
     scope: &DType,
     annotate_fn: A,
 ) -> VortexResult<PartitionedExpr<A::Annotation>>
+where
+    A::Annotation: Display,
+    FieldName: From<A::Annotation>,
+{
+    partition_scope(expr, &Scope::new(scope.clone()), annotate_fn)
+}
+
+/// Partition an expression against a lexical scope.
+///
+/// Variable references remain leaves in the resulting partitions and are resolved from `scope`
+/// when the partitions are later bound or applied.
+pub fn partition_scope<A: AnnotationFn>(
+    expr: Expression,
+    scope: &Scope,
+    annotate_fn: A,
+) -> VortexResult<PartitionedExpr<A::Annotation>>
 where
     A::Annotation: Display,
     FieldName: From<A::Annotation>,
 {
     // Annotate each expression with the annotations that any of its descendent expressions have.
     let annotations = descendent_annotations(&expr, annotate_fn);
-    partition_annotations(expr.clone(), scope, annotations)
+    partition_annotations_scope(expr.clone(), scope, annotations)
 }
 
 pub fn partition_annotations<A>(
@@ -58,6 +75,19 @@ pub fn partition_annotations<A>(
     scope: &DType,
     annotations: Annotations<A>,
 ) -> VortexResult<PartitionedExpr<A>>
+where
+    A: Display + Clone + Eq + Hash,
+    FieldName: From<A>,
+{
+    partition_annotations_scope(expr, &Scope::new(scope.clone()), annotations)
+}
+
+/// Partition an expression with already-computed annotations against a lexical scope.
+pub fn partition_annotations_scope<A>(
+    expr: Expression,
+    scope: &Scope,
+    annotations: Annotations<A>,
+) -> VortexResult<PartitionedExpr<A>>
 where
     A: Display + Clone + Eq + Hash,
     FieldName: From<A>,
@@ -83,8 +113,8 @@ where
             Nullability::NonNullable,
         );
 
-        let expr = expr.optimize_recursive(scope)?;
-        let expr_dtype = expr.return_dtype(scope)?;
+        let expr = expr.optimize_recursive_scope(scope)?;
+        let expr_dtype = expr.return_dtype_scope(scope)?;
 
         partitions.push(expr);
         partition_annotations.push(annotation);
@@ -101,7 +131,7 @@ where
     );
 
     Ok(PartitionedExpr {
-        root: root.optimize_recursive(&root_scope)?,
+        root: root.optimize_recursive_scope(&scope.with_root(root_scope))?,
         partitions: partitions.into_boxed_slice(),
         partition_names,
         partition_dtypes: partition_dtypes.into_boxed_slice(),
@@ -223,6 +253,8 @@ mod tests {
     use crate::dtype::Nullability::NonNullable;
     use crate::dtype::PType::I32;
     use crate::dtype::StructFields;
+    use crate::expr::Scope;
+    use crate::expr::Variable;
     use crate::expr::analysis::make_free_field_annotator;
     use crate::expr::and;
     use crate::expr::col;
@@ -232,6 +264,7 @@ mod tests {
     use crate::expr::pack;
     use crate::expr::root;
     use crate::expr::transform::replace::replace_root_fields;
+    use crate::expr::var;
 
     #[fixture]
     fn dtype() -> DType {
@@ -270,6 +303,22 @@ mod tests {
         assert_eq!(partitioned.partitions.len(), fields.names().len());
     }
 
+    #[rstest]
+    fn partition_scope_preserves_lexical_variables(dtype: DType) -> VortexResult<()> {
+        let scope = Scope::new(dtype.clone())
+            .with_bindings([(Variable::new("offset"), DType::Primitive(I32, NonNullable))])?;
+        let fields = dtype
+            .as_struct_fields_opt()
+            .vortex_expect("test dtype must be a struct");
+        let expression = crate::expr::checked_add(var("offset"), col("b"));
+
+        let partitioned = partition_scope(expression, &scope, make_free_field_annotator(fields))?;
+
+        assert_eq!(partitioned.partitions.len(), 1);
+        assert!(partitioned.partitions[0].to_string().contains("$offset"));
+        Ok(())
+    }
+
     #[rstest]
     fn test_expr_top_level_ref_get_item_and_split(dtype: DType) {
         let fields = dtype.as_struct_fields_opt().unwrap();
diff --git a/vortex-array/src/expr/traversal/mod.rs b/vortex-array/src/expr/traversal/mod.rs
index b97ae2536f7..4dd0b334e27 100644
--- a/vortex-array/src/expr/traversal/mod.rs
+++ b/vortex-array/src/expr/traversal/mod.rs
@@ -24,7 +24,6 @@ use vortex_error::VortexResult;
 
 use crate::expr::BoundExpression;
 use crate::expr::Expression;
-use crate::expr::bound_expression::BoundKind;
 use crate::expr::traversal::fold::NodeFolderContextWrapper;
 
 /// Signal to control a traversal's flow
@@ -534,8 +533,14 @@ impl Node for BoundExpression {
         &'a self,
         mut f: F,
     ) -> VortexResult<TraversalOrder> {
-        let BoundKind::Scalar { children, .. } = self.kind() else {
-            return Ok(TraversalOrder::Continue);
+        let children: &[Self] = match self {
+            BoundExpression::Scalar { children, .. }
+            | BoundExpression::HigherOrder { children, .. } => children,
+            BoundExpression::Lambda { .. }
+            | BoundExpression::Root { .. }
+            | BoundExpression::Variable { .. } => {
+                return Ok(TraversalOrder::Continue);
+            }
         };
 
         for child in children.iter() {
@@ -552,8 +557,14 @@ impl Node for BoundExpression {
         self,
         mut f: F,
     ) -> VortexResult<Transformed<Self>> {
-        let BoundKind::Scalar { children, .. } = self.kind() else {
-            return Ok(Transformed::no(self));
+        let children: &[Self] = match &self {
+            BoundExpression::Scalar { children, .. }
+            | BoundExpression::HigherOrder { children, .. } => children,
+            BoundExpression::Lambda { .. }
+            | BoundExpression::Root { .. }
+            | BoundExpression::Variable { .. } => {
+                return Ok(Transformed::no(self));
+            }
         };
 
         let mut order = TraversalOrder::Continue;
@@ -583,16 +594,22 @@ impl Node for BoundExpression {
     }
 
     fn iter_children<T>(&self, f: impl FnOnce(&mut dyn Iterator<Item = &Self>) -> T) -> T {
-        match self.kind() {
-            BoundKind::Scalar { children, .. } => f(&mut children.iter()),
-            BoundKind::Root => f(&mut std::iter::empty()),
+        match self {
+            BoundExpression::Scalar { children, .. }
+            | BoundExpression::HigherOrder { children, .. } => f(&mut children.iter()),
+            BoundExpression::Lambda { .. }
+            | BoundExpression::Root { .. }
+            | BoundExpression::Variable { .. } => f(&mut std::iter::empty()),
         }
     }
 
     fn children_count(&self) -> usize {
-        match self.kind() {
-            BoundKind::Scalar { children, .. } => children.len(),
-            BoundKind::Root => 0,
+        match self {
+            BoundExpression::Scalar { children, .. }
+            | BoundExpression::HigherOrder { children, .. } => children.len(),
+            BoundExpression::Lambda { .. }
+            | BoundExpression::Root { .. }
+            | BoundExpression::Variable { .. } => 0,
         }
     }
 }
diff --git a/vortex-array/src/expr/variable.rs b/vortex-array/src/expr/variable.rs
new file mode 100644
index 00000000000..68e6e63ca00
--- /dev/null
+++ b/vortex-array/src/expr/variable.rs
@@ -0,0 +1,96 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: Copyright the Vortex contributors
+
+use std::fmt;
+use std::fmt::Display;
+use std::fmt::Formatter;
+use std::hash::Hash;
+use std::hash::Hasher;
+use std::sync::Arc;
+
+use crate::expr::Expression;
+
+/// The name of a value bound in a [`Scope`](crate::expr::Scope).
+#[derive(Clone, Debug)]
+pub struct Variable(Arc<str>);
+
+impl Variable {
+    /// Create a variable with the given name.
+    pub fn new(name: impl AsRef<str>) -> Self {
+        Self(Arc::from(name.as_ref()))
+    }
+
+    /// The variable's name.
+    pub fn name(&self) -> &str {
+        &self.0
+    }
+}
+
+/// Compares by name, with a pointer-equality fast path for the common case of a cloned handle.
+impl PartialEq for Variable {
+    fn eq(&self, other: &Self) -> bool {
+        Arc::ptr_eq(&self.0, &other.0) || self.0 == other.0
+    }
+}
+
+impl Eq for Variable {}
+
+impl Hash for Variable {
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        // Hash the name, not the pointer, so equal names hash equally.
+        self.0.hash(state);
+    }
+}
+
+impl Display for Variable {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        write!(f, "{}", self.0)
+    }
+}
+
+impl From<Variable> for Expression {
+    fn from(variable: Variable) -> Self {
+        Expression::Variable(variable)
+    }
+}
+
+impl<T: AsRef<str>> From<T> for Variable {
+    fn from(name: T) -> Self {
+        Self::new(name)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn equality_is_by_name_not_identity() {
+        let x1 = Variable::new("x");
+        let x2 = Variable::new("x");
+        let y = Variable::new("y");
+
+        // Independently constructed, so no shared allocation to short-circuit on.
+        assert_eq!(x1, x2);
+        assert_ne!(x1, y);
+    }
+
+    #[test]
+    fn equal_variables_hash_equally() {
+        use std::collections::hash_map::RandomState;
+        use std::hash::BuildHasher;
+
+        let state = RandomState::new();
+        assert_eq!(
+            state.hash_one(Variable::new("x")),
+            state.hash_one(Variable::new("x"))
+        );
+    }
+
+    #[test]
+    fn cloning_shares_the_name() {
+        let original = Variable::new("x");
+        let cloned = original.clone();
+        assert!(Arc::ptr_eq(&original.0, &cloned.0));
+    }
+}
diff --git a/vortex-array/src/expression.rs b/vortex-array/src/expression.rs
index a1a46196766..510a5c89637 100644
--- a/vortex-array/src/expression.rs
+++ b/vortex-array/src/expression.rs
@@ -2,72 +2,204 @@
 // SPDX-FileCopyrightText: Copyright the Vortex contributors
 
 use itertools::Itertools;
-use vortex_error::VortexExpect;
 use vortex_error::VortexResult;
+use vortex_error::vortex_err;
+use vortex_utils::aliases::hash_map::HashMap;
 
 use crate::ArrayRef;
+use crate::ExecutionCtx;
 use crate::IntoArray;
+use crate::VortexSessionExecute;
+use crate::array_session;
 use crate::arrays::ConstantArray;
 use crate::arrays::ScalarFnArray;
 use crate::expr::BoundExpression;
-use crate::expr::BoundKind;
+use crate::expr::BoundLambda;
 use crate::expr::Expression;
+use crate::expr::VariableRef;
+use crate::higher_order_fn::LambdaCall;
 use crate::optimizer::ArrayOptimizer;
 use crate::scalar_fn::fns::literal::Literal;
 
-impl ArrayRef {
-    /// Apply a bound expression to this array, producing a new array in constant time.
-    pub fn apply_bound(self, expr: &BoundExpression) -> VortexResult<ArrayRef> {
-        let BoundKind::Scalar {
-            scalar_fn,
-            children,
-        } = expr.kind()
-        else {
-            return Ok(self);
-        };
+/// State shared while an expression is applied to an array.
+///
+/// The context tracks the current root array, lexical bindings, and the execution context used by
+/// structural lowerings. It is an implementation detail of [`ArrayRef::apply`] rather than an
+/// alternative evaluation layer.
+pub(crate) struct ApplyCtx<'a> {
+    root: ArrayRef,
+    bindings: HashMap<VariableRef, ArrayRef>,
+    execution_ctx: Option<ApplyExecutionCtx<'a>>,
+}
 
-        if let Some(scalar) = scalar_fn.as_opt::<Literal>() {
-            return Ok(ConstantArray::new(scalar.clone(), self.len()).into_array());
+enum ApplyExecutionCtx<'a> {
+    Borrowed(&'a mut ExecutionCtx),
+    Owned(ExecutionCtx),
+}
+
+impl<'a> ApplyCtx<'a> {
+    fn new(root: ArrayRef) -> Self {
+        Self {
+            root,
+            bindings: HashMap::new(),
+            execution_ctx: None,
         }
+    }
 
-        let children: Vec<_> = children
-            .iter()
-            .map(|child| self.clone().apply_bound(child))
-            .try_collect()?;
+    fn with_execution_ctx(root: ArrayRef, execution_ctx: &'a mut ExecutionCtx) -> Self {
+        Self {
+            root,
+            bindings: HashMap::new(),
+            execution_ctx: Some(ApplyExecutionCtx::Borrowed(execution_ctx)),
+        }
+    }
+
+    pub(crate) fn with_bindings(
+        root: ArrayRef,
+        bindings: HashMap<VariableRef, ArrayRef>,
+        execution_ctx: &'a mut ExecutionCtx,
+    ) -> Self {
+        Self {
+            root,
+            bindings,
+            execution_ctx: Some(ApplyExecutionCtx::Borrowed(execution_ctx)),
+        }
+    }
 
-        let array =
-            ScalarFnArray::try_new_with_len(scalar_fn.clone(), children, self.len())?.into_array();
+    fn binding(&self, variable_ref: VariableRef) -> Option<&ArrayRef> {
+        self.bindings.get(&variable_ref)
+    }
 
-        array.optimize()
+    fn execution_ctx(&mut self) -> &mut ExecutionCtx {
+        if self.execution_ctx.is_none() {
+            self.execution_ctx = Some(ApplyExecutionCtx::Owned(
+                array_session().create_execution_ctx(),
+            ));
+        }
+        match self.execution_ctx.as_mut() {
+            Some(ApplyExecutionCtx::Borrowed(ctx)) => ctx,
+            Some(ApplyExecutionCtx::Owned(ctx)) => ctx,
+            None => unreachable!("an execution context was initialized above"),
+        }
+    }
+
+    fn close_lambda(&self, lambda: BoundLambda) -> VortexResult<LambdaCall> {
+        let captures = lambda
+            .free_variables()
+            .into_iter()
+            .map(|variable_ref| {
+                self.binding(variable_ref)
+                    .cloned()
+                    .map(|array| (variable_ref, array))
+                    .ok_or_else(|| {
+                        vortex_err!(
+                            "cannot capture missing lexical binding at frame {}, slot {}",
+                            variable_ref.frame(),
+                            variable_ref.slot()
+                        )
+                    })
+            })
+            .collect::<VortexResult<Vec<_>>>()?;
+        Ok(LambdaCall::new(lambda, captures))
+    }
+}
+
+impl ArrayRef {
+    /// Apply a bound expression to this array, producing a new array in constant time.
+    pub fn apply_bound(self, expr: &BoundExpression) -> VortexResult<ArrayRef> {
+        expr.apply(&mut ApplyCtx::new(self))
+    }
+
+    /// Apply a bound expression using an explicit execution context for structural lowerings.
+    pub fn apply_bound_with_ctx(
+        self,
+        expr: &BoundExpression,
+        execution_ctx: &mut ExecutionCtx,
+    ) -> VortexResult<ArrayRef> {
+        expr.apply(&mut ApplyCtx::with_execution_ctx(self, execution_ctx))
     }
 
     /// Apply the expression to this array, producing a new array in constant time.
     pub fn apply(self, expr: &Expression) -> VortexResult<ArrayRef> {
-        // If the expression is a root, return self.
-        if expr.is_root() {
-            return Ok(self);
-        }
+        let bound = expr.bind(self.dtype())?;
+        self.apply_bound(&bound)
+    }
+
+    /// Apply an expression using an explicit execution context for structural lowerings.
+    pub fn apply_with_ctx(
+        self,
+        expr: &Expression,
+        execution_ctx: &mut ExecutionCtx,
+    ) -> VortexResult<ArrayRef> {
+        let bound = expr.bind(self.dtype())?;
+        self.apply_bound_with_ctx(&bound, execution_ctx)
+    }
+}
 
-        // Manually convert literals to ConstantArray.
-        if let Some(scalar) = expr.as_opt::<Literal>() {
-            return Ok(ConstantArray::new(scalar.clone(), self.len()).into_array());
+impl BoundExpression {
+    /// Apply this expression in `ctx`'s current lexical and row domain.
+    pub(crate) fn apply(&self, ctx: &mut ApplyCtx<'_>) -> VortexResult<ArrayRef> {
+        let (scalar_fn, children) = match self {
+            BoundExpression::Root { .. } => return Ok(ctx.root.clone()),
+            BoundExpression::Variable {
+                variable,
+                variable_ref,
+                ..
+            } => {
+                return ctx
+                    .binding(*variable_ref)
+                    .cloned()
+                    .ok_or_else(|| vortex_err!("cannot apply unbound variable '{variable}'"));
+            }
+            BoundExpression::HigherOrder {
+                higher_order_fn,
+                children,
+                lambdas,
+                ..
+            } => {
+                let children: Vec<_> = children
+                    .iter()
+                    .map(|child| child.apply(ctx))
+                    .try_collect()?;
+                let lambdas = lambdas
+                    .iter()
+                    .map(|lambda| {
+                        lambda
+                            .as_lambda()
+                            .cloned()
+                            .ok_or_else(|| {
+                                vortex_err!(
+                                    "higher-order expression contained a non-lambda argument"
+                                )
+                            })
+                            .and_then(|lambda| ctx.close_lambda(lambda))
+                    })
+                    .collect::<VortexResult<Vec<_>>>()?;
+                return higher_order_fn.apply(&children, &lambdas, ctx.execution_ctx());
+            }
+            BoundExpression::Lambda { .. } => {
+                return Err(vortex_err!(
+                    "a lambda can be applied only by a higher-order function"
+                ));
+            }
+            BoundExpression::Scalar {
+                scalar_fn,
+                children,
+                ..
+            } => (scalar_fn, children),
+        };
+
+        if let Some(scalar) = scalar_fn.as_opt::<Literal>() {
+            return Ok(ConstantArray::new(scalar.clone(), ctx.root.len()).into_array());
         }
 
-        // Otherwise, collect the child arrays.
-        let children: Vec<_> = expr
-            .children()
+        let children = children
             .iter()
-            .map(|e| self.clone().apply(e))
+            .map(|child| child.apply(ctx))
             .try_collect()?;
+        let array = ScalarFnArray::try_new_with_len(scalar_fn.clone(), children, ctx.root.len())?
+            .into_array();
 
-        // And wrap the scalar function up in an array.
-        let scalar_fn = expr
-            .as_scalar()
-            .vortex_expect("root and literal were handled above, so this is a scalar node");
-        let array =
-            ScalarFnArray::try_new_with_len(scalar_fn.clone(), children, self.len())?.into_array();
-
-        // Optimize the resulting array's root.
         array.optimize()
     }
 }
diff --git a/vortex-array/src/higher_order_fn/erased.rs b/vortex-array/src/higher_order_fn/erased.rs
new file mode 100644
index 00000000000..b00f11e7c7b
--- /dev/null
+++ b/vortex-array/src/higher_order_fn/erased.rs
@@ -0,0 +1,217 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: Copyright the Vortex contributors
+
+use std::any::type_name;
+use std::fmt;
+use std::fmt::Debug;
+use std::fmt::Display;
+use std::fmt::Formatter;
+use std::hash::Hash;
+use std::hash::Hasher;
+use std::sync::Arc;
+
+use vortex_error::VortexExpect;
+use vortex_error::VortexResult;
+use vortex_error::vortex_err;
+use vortex_utils::debug_with::DebugWith;
+
+use crate::ArrayRef;
+use crate::ExecutionCtx;
+use crate::dtype::DType;
+use crate::expr::BoundLambdaArgs;
+use crate::expr::Lambda;
+use crate::expr::display::HigherOrderExprDisplay;
+use crate::higher_order_fn::HigherOrderFunctionId;
+use crate::higher_order_fn::HigherOrderFunctionOptions;
+use crate::higher_order_fn::HigherOrderFunctionVTable;
+use crate::higher_order_fn::LambdaCall;
+use crate::higher_order_fn::LambdaSignature;
+use crate::higher_order_fn::TypedHigherOrderFunctionInstance;
+use crate::higher_order_fn::typed::DynHigherOrderFunction;
+use crate::scalar_fn::Arity;
+use crate::scalar_fn::ChildName;
+use crate::validity::Validity;
+
+/// A type-erased higher-order function, pairing a vtable with bound per-call options.
+#[derive(Clone)]
+pub struct HigherOrderFunctionRef(pub(super) Arc<dyn DynHigherOrderFunction>);
+
+impl HigherOrderFunctionRef {
+    /// Bind `vtable` with its per-call `options`.
+    pub fn new<V: HigherOrderFunctionVTable>(vtable: V, options: V::Options) -> Self {
+        TypedHigherOrderFunctionInstance::new(vtable, options).erased()
+    }
+
+    /// The function's global identifier.
+    pub fn id(&self) -> HigherOrderFunctionId {
+        self.0.id()
+    }
+
+    /// Whether this function uses vtable `V`.
+    pub fn is<V: HigherOrderFunctionVTable>(&self) -> bool {
+        self.0.as_any().is::<TypedHigherOrderFunctionInstance<V>>()
+    }
+
+    /// Return typed options when this function uses vtable `V`.
+    pub fn as_opt<V: HigherOrderFunctionVTable>(&self) -> Option<&V::Options> {
+        self.0
+            .as_any()
+            .downcast_ref::<TypedHigherOrderFunctionInstance<V>>()
+            .map(TypedHigherOrderFunctionInstance::options)
+    }
+
+    /// Return typed options for vtable `V`.
+    ///
+    /// # Panics
+    ///
+    /// Panics if this function does not use vtable `V`.
+    pub fn as_<V: HigherOrderFunctionVTable>(&self) -> &V::Options {
+        self.as_opt::<V>()
+            .vortex_expect("higher-order function options type mismatch")
+    }
+
+    /// Return these options behind an opaque type-erased handle.
+    pub fn options(&self) -> HigherOrderFunctionOptions<'_> {
+        HigherOrderFunctionOptions { inner: &*self.0 }
+    }
+
+    /// Return the arity of the ordinary expression children.
+    pub fn arity(&self) -> Arity {
+        self.0.arity()
+    }
+
+    /// Return the number of lambda arguments.
+    pub fn lambda_arity(&self) -> usize {
+        self.0.lambda_arity()
+    }
+
+    /// Return the name of an ordinary expression child.
+    pub fn child_name(&self, child_idx: usize) -> ChildName {
+        self.0.child_name(child_idx)
+    }
+
+    /// Serialize the per-call options.
+    pub fn serialize(&self) -> VortexResult<Option<Vec<u8>>> {
+        self.0.options_serialize()
+    }
+
+    /// Coerce ordinary input arguments before the lambdas are bound.
+    pub fn coerce_input_args(&self, arg_dtypes: &[DType]) -> VortexResult<Vec<DType>> {
+        self.0.coerce_input_args(arg_dtypes)
+    }
+
+    pub(crate) fn lambda_signatures(
+        &self,
+        arg_dtypes: &[DType],
+        lambdas: &[&Lambda],
+    ) -> VortexResult<Box<[LambdaSignature]>> {
+        self.0.lambda_signatures(arg_dtypes, lambdas)
+    }
+
+    /// Compute this higher-order expression's result dtype.
+    pub fn return_dtype(
+        &self,
+        args: &[DType],
+        lambdas: BoundLambdaArgs<'_>,
+    ) -> VortexResult<DType> {
+        self.0.return_dtype(args, lambdas)
+    }
+
+    /// Compute this higher-order expression's result validity.
+    pub fn validity(
+        &self,
+        args: &[ArrayRef],
+        lambdas: BoundLambdaArgs<'_>,
+    ) -> VortexResult<Validity> {
+        self.0.validity(args, lambdas)
+    }
+
+    /// Lower this higher-order expression over applied inputs and closed lambdas.
+    pub fn apply(
+        &self,
+        args: &[ArrayRef],
+        lambdas: &[LambdaCall],
+        execution_ctx: &mut ExecutionCtx,
+    ) -> VortexResult<ArrayRef> {
+        self.0.apply(args, lambdas, execution_ctx)
+    }
+
+    /// Whether evaluation can raise a semantic error.
+    pub fn is_fallible(&self, lambdas: BoundLambdaArgs<'_>) -> bool {
+        self.0.is_fallible(lambdas)
+    }
+
+    /// Format an unbound or bound higher-order expression in SQL-style notation.
+    pub(crate) fn fmt_sql(
+        &self,
+        expr: &dyn HigherOrderExprDisplay,
+        f: &mut Formatter<'_>,
+    ) -> fmt::Result {
+        self.0.fmt_sql(expr, f)
+    }
+}
+
+impl Debug for HigherOrderFunctionRef {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        f.debug_struct("HigherOrderFunctionRef")
+            .field("vtable", &self.id())
+            .field("options", &DebugWith(|fmt| self.0.options_debug(fmt)))
+            .finish()
+    }
+}
+
+impl Display for HigherOrderFunctionRef {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        write!(f, "{}(", self.id())?;
+        self.0.options_display(f)?;
+        write!(f, ")")
+    }
+}
+
+impl PartialEq for HigherOrderFunctionRef {
+    fn eq(&self, other: &Self) -> bool {
+        self.id() == other.id() && self.0.options_eq(other.0.options_any())
+    }
+}
+
+impl Eq for HigherOrderFunctionRef {}
+
+impl Hash for HigherOrderFunctionRef {
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        self.id().hash(state);
+        self.0.options_hash(state);
+    }
+}
+
+impl HigherOrderFunctionRef {
+    /// Downcast this function to its typed representation.
+    pub fn try_downcast<V: HigherOrderFunctionVTable>(
+        self,
+    ) -> Result<Arc<TypedHigherOrderFunctionInstance<V>>, Self> {
+        if self.is::<V>() {
+            let ptr = Arc::into_raw(self.0) as *const TypedHigherOrderFunctionInstance<V>;
+            Ok(unsafe { Arc::from_raw(ptr) })
+        } else {
+            Err(self)
+        }
+    }
+
+    /// Downcast this function to its typed representation.
+    ///
+    /// # Panics
+    ///
+    /// Panics if this function does not use vtable `V`.
+    pub fn downcast<V: HigherOrderFunctionVTable>(
+        self,
+    ) -> Arc<TypedHigherOrderFunctionInstance<V>> {
+        self.try_downcast::<V>()
+            .map_err(|function| {
+                vortex_err!(
+                    "failed to downcast higher-order function {} to {}",
+                    function.id(),
+                    type_name::<V>(),
+                )
+            })
+            .vortex_expect("failed to downcast higher-order function")
+    }
+}
diff --git a/vortex-array/src/higher_order_fn/fns/list_transform.rs b/vortex-array/src/higher_order_fn/fns/list_transform.rs
new file mode 100644
index 00000000000..e760304e47b
--- /dev/null
+++ b/vortex-array/src/higher_order_fn/fns/list_transform.rs
@@ -0,0 +1,893 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: Copyright the Vortex contributors
+
+use vortex_buffer::BufferMut;
+use vortex_error::VortexResult;
+use vortex_error::vortex_bail;
+use vortex_error::vortex_ensure;
+use vortex_error::vortex_err;
+use vortex_session::registry::CachedId;
+
+use crate::ArrayRef;
+use crate::Canonical;
+use crate::IntoArray;
+use crate::arrays::BoolArray;
+use crate::arrays::FixedSizeList;
+use crate::arrays::FixedSizeListArray;
+use crate::arrays::List;
+use crate::arrays::ListArray;
+use crate::arrays::ListView;
+use crate::arrays::ListViewArray;
+use crate::arrays::PrimitiveArray;
+use crate::arrays::fixed_size_list::FixedSizeListArrayExt;
+use crate::arrays::fixed_size_list::FixedSizeListArraySlotsExt;
+use crate::arrays::list::ListArrayExt;
+use crate::arrays::list::ListArraySlotsExt;
+use crate::arrays::listview::ListViewArrayExt;
+use crate::arrays::listview::ListViewArraySlotsExt;
+use crate::builtins::ArrayBuiltins;
+use crate::dtype::DType;
+use crate::dtype::Nullability;
+use crate::dtype::PType;
+use crate::expr::BoundLambda;
+use crate::expr::BoundLambdaArgs;
+use crate::expr::Lambda;
+use crate::higher_order_fn::EmptyOptions;
+use crate::higher_order_fn::HigherOrderFunctionId;
+use crate::higher_order_fn::HigherOrderFunctionVTable;
+use crate::higher_order_fn::LambdaCall;
+use crate::higher_order_fn::LambdaSignature;
+use crate::matcher::Matcher;
+use crate::scalar_fn::Arity;
+use crate::scalar_fn::ChildName;
+use crate::validity::Validity;
+
+/// Applies a single-argument lambda to every element of a list.
+///
+/// The input's list structure and list-level validity are retained while the lambda transforms
+/// the elements array. Nested invocation rebases captured outer parameters from list rows to
+/// element rows before evaluating the lambda body.
+#[derive(Clone, Debug)]
+pub struct ListTransform;
+
+impl HigherOrderFunctionVTable for ListTransform {
+    type Options = EmptyOptions;
+
+    fn id(&self) -> HigherOrderFunctionId {
+        static ID: CachedId = CachedId::new("vortex.list.transform");
+        *ID
+    }
+
+    fn serialize(&self, _options: &Self::Options) -> VortexResult<Option<Vec<u8>>> {
+        Ok(Some(vec![]))
+    }
+
+    fn deserialize(
+        &self,
+        metadata: &[u8],
+        _session: &vortex_session::VortexSession,
+    ) -> VortexResult<Self::Options> {
+        if metadata.is_empty() {
+            Ok(EmptyOptions)
+        } else {
+            vortex_bail!("list_transform() does not accept metadata")
+        }
+    }
+
+    fn arity(&self, _options: &Self::Options) -> Arity {
+        Arity::Exact(1)
+    }
+
+    fn lambda_arity(&self, _options: &Self::Options) -> usize {
+        1
+    }
+
+    fn child_name(&self, _options: &Self::Options, child_idx: usize) -> ChildName {
+        match child_idx {
+            0 => ChildName::from("input"),
+            _ => unreachable!("invalid child index {child_idx} for list_transform()"),
+        }
+    }
+
+    fn lambda_signatures(
+        &self,
+        _options: &Self::Options,
+        args: &[DType],
+        lambdas: &[&Lambda],
+    ) -> VortexResult<Box<[LambdaSignature]>> {
+        let [lambda] = lambdas else {
+            vortex_bail!("list_transform() requires exactly one lambda");
+        };
+        vortex_ensure!(
+            lambda.params().len() == 1,
+            "list_transform() lambda must take exactly one parameter, got {}",
+            lambda.params().len()
+        );
+        let (element, list_nullability) = match &args[0] {
+            DType::List(element, nullability) | DType::FixedSizeList(element, _, nullability) => {
+                (element, *nullability)
+            }
+            dtype => vortex_bail!("list_transform() requires List or FixedSizeList, got {dtype}"),
+        };
+        // A null list owns no observable elements, but its physical elements are still present in
+        // the child array. Bind nullable list inputs as nullable lambda arguments so lowering can
+        // push the list validity into the scalar-function child before it is evaluated.
+        let element = match list_nullability {
+            Nullability::NonNullable => element.as_ref().clone(),
+            Nullability::Nullable => element.as_nullable(),
+        };
+        Ok(Box::new([LambdaSignature::new(element.clone(), [element])]))
+    }
+
+    fn return_dtype(
+        &self,
+        _options: &Self::Options,
+        args: &[DType],
+        lambdas: BoundLambdaArgs<'_>,
+    ) -> VortexResult<DType> {
+        list_transform_dtype(args, lambdas.get(0))
+    }
+
+    fn validity(
+        &self,
+        _options: &Self::Options,
+        args: &[ArrayRef],
+        _lambdas: BoundLambdaArgs<'_>,
+    ) -> VortexResult<Validity> {
+        let [input] = args else {
+            vortex_bail!("list_transform() requires exactly one input");
+        };
+        input.validity()
+    }
+
+    fn apply(
+        &self,
+        _options: &Self::Options,
+        args: &[ArrayRef],
+        lambdas: &[LambdaCall],
+        execution_ctx: &mut crate::ExecutionCtx,
+    ) -> VortexResult<ArrayRef> {
+        let [input] = args else {
+            vortex_bail!("list_transform() requires exactly one input");
+        };
+        let [lambda] = lambdas else {
+            vortex_bail!("list_transform() requires exactly one lambda");
+        };
+        let output_dtype =
+            list_transform_dtype(std::slice::from_ref(input.dtype()), Some(lambda.lambda()))?;
+        if input.is_empty() {
+            return Ok(Canonical::empty(&output_dtype).into_array());
+        }
+
+        // Do not execute a concrete list encoding: `execute_until` may canonicalize a ListView
+        // into a List, which would discard the structural layout this lowering can preserve.
+        let input = if input.as_opt::<List>().is_some()
+            || input.as_opt::<ListView>().is_some()
+            || input.as_opt::<FixedSizeList>().is_some()
+        {
+            input.clone()
+        } else {
+            input.clone().execute_until::<AnyList>(execution_ctx)?
+        };
+        transform_list(&input, lambda, execution_ctx)
+    }
+}
+
+fn list_transform_dtype(args: &[DType], lambda: Option<&BoundLambda>) -> VortexResult<DType> {
+    let Some(lambda) = lambda else {
+        vortex_bail!("list_transform() requires exactly one lambda");
+    };
+    let [input] = args else {
+        vortex_bail!("list_transform() requires exactly one input");
+    };
+    match input {
+        DType::List(_, nullability) => Ok(DType::List(
+            lambda.body_dtype().clone().into(),
+            *nullability,
+        )),
+        DType::FixedSizeList(_, size, nullability) => Ok(DType::FixedSizeList(
+            lambda.body_dtype().clone().into(),
+            *size,
+            *nullability,
+        )),
+        dtype => vortex_bail!("list_transform() requires List or FixedSizeList, got {dtype}"),
+    }
+}
+
+fn transform_list(
+    input: &ArrayRef,
+    lambda: &LambdaCall,
+    ctx: &mut crate::ExecutionCtx,
+) -> VortexResult<ArrayRef> {
+    if let Some(fixed_size_list) = input.as_opt::<FixedSizeList>() {
+        let validity = fixed_size_list.fixed_size_list_validity();
+        let parent_indices = lambda.has_captures().then(|| {
+            fixed_size_list_parent_indices(
+                fixed_size_list.list_size() as usize,
+                fixed_size_list.len(),
+            )
+        });
+        let elements = fixed_size_list.elements();
+        return Ok(FixedSizeListArray::new(
+            apply_lambda(
+                lambda,
+                elements.clone(),
+                fixed_size_list_element_mask(
+                    lambda,
+                    elements,
+                    fixed_size_list.list_size() as usize,
+                    &validity,
+                    fixed_size_list.len(),
+                    ctx,
+                )?,
+                parent_indices.as_ref(),
+                ctx,
+            )?,
+            fixed_size_list.list_size(),
+            validity,
+            fixed_size_list.len(),
+        )
+        .into_array());
+    }
+
+    if input.as_opt::<ListView>().is_none()
+        && let Some(list) = input.as_opt::<List>()
+    {
+        let validity = list.list_validity();
+        if lambda.has_captures() {
+            let (elements, offsets, parent_indices) = gather_referenced_elements(
+                list.elements(),
+                list.offsets(),
+                None,
+                &validity,
+                list.len(),
+                ctx,
+            )?;
+            return Ok(ListArray::try_new(
+                apply_lambda(
+                    lambda,
+                    elements,
+                    None,
+                    lambda.has_captures().then_some(&parent_indices),
+                    ctx,
+                )?,
+                offsets,
+                validity,
+            )?
+            .into_array());
+        }
+
+        return Ok(ListArray::try_new(
+            apply_lambda(
+                lambda,
+                list.elements().clone(),
+                list_element_mask(
+                    lambda,
+                    list.elements(),
+                    list.offsets(),
+                    &validity,
+                    list.len(),
+                    ctx,
+                )?,
+                None,
+                ctx,
+            )?,
+            list.offsets().clone(),
+            validity,
+        )?
+        .into_array());
+    }
+
+    if let Some(list_view) = input.as_opt::<ListView>() {
+        let validity = list_view.listview_validity();
+        if lambda.has_captures() {
+            let (elements, offsets, parent_indices) = gather_referenced_elements(
+                list_view.elements(),
+                list_view.offsets(),
+                Some(list_view.sizes()),
+                &validity,
+                list_view.len(),
+                ctx,
+            )?;
+            return Ok(ListArray::try_new(
+                apply_lambda(
+                    lambda,
+                    elements,
+                    None,
+                    lambda.has_captures().then_some(&parent_indices),
+                    ctx,
+                )?,
+                offsets,
+                validity,
+            )?
+            .into_array());
+        }
+
+        return Ok(ListViewArray::new(
+            apply_lambda(
+                lambda,
+                list_view.elements().clone(),
+                list_view_element_mask(
+                    lambda,
+                    list_view.elements(),
+                    list_view.offsets(),
+                    list_view.sizes(),
+                    &validity,
+                    list_view.len(),
+                    ctx,
+                )?,
+                None,
+                ctx,
+            )?,
+            list_view.offsets().clone(),
+            list_view.sizes().clone(),
+            validity,
+        )
+        .into_array());
+    }
+
+    let dtype = input.dtype();
+    vortex_bail!("list_transform() requires List, ListView, or FixedSizeList, got {dtype}")
+}
+
+/// Apply `lambda` to its element argument, optionally masking unobservable child values first.
+fn apply_lambda(
+    lambda: &LambdaCall,
+    elements: ArrayRef,
+    element_mask: Option<ArrayRef>,
+    parent_indices: Option<&ArrayRef>,
+    ctx: &mut crate::ExecutionCtx,
+) -> VortexResult<ArrayRef> {
+    let [param_dtype] = lambda.lambda().param_dtypes() else {
+        unreachable!("list_transform binds exactly one lambda parameter")
+    };
+    let elements = match element_mask {
+        Some(mask) => elements.mask(mask)?,
+        None if elements.dtype() != param_dtype => elements.cast(param_dtype.clone())?,
+        None => elements,
+    };
+    lambda.apply(
+        elements.clone(),
+        std::slice::from_ref(&elements),
+        parent_indices,
+        ctx,
+    )
+}
+
+fn requires_element_mask(lambda: &LambdaCall, elements: &ArrayRef) -> bool {
+    let [param_dtype] = lambda.lambda().param_dtypes() else {
+        unreachable!("list_transform binds exactly one lambda parameter")
+    };
+    elements.dtype() != param_dtype
+}
+
+fn fixed_size_list_element_mask(
+    lambda: &LambdaCall,
+    elements: &ArrayRef,
+    list_size: usize,
+    validity: &Validity,
+    len: usize,
+    ctx: &mut crate::ExecutionCtx,
+) -> VortexResult<Option<ArrayRef>> {
+    if !requires_element_mask(lambda, elements) {
+        return Ok(None);
+    }
+
+    let parent_mask = validity.execute_mask(len, ctx)?;
+    Ok(Some(
+        BoolArray::from_iter(
+            (0..len).flat_map(|row| std::iter::repeat_n(parent_mask.value(row), list_size)),
+        )
+        .into_array(),
+    ))
+}
+
+fn list_element_mask(
+    lambda: &LambdaCall,
+    elements: &ArrayRef,
+    offsets: &ArrayRef,
+    validity: &Validity,
+    len: usize,
+    ctx: &mut crate::ExecutionCtx,
+) -> VortexResult<Option<ArrayRef>> {
+    if !requires_element_mask(lambda, elements) {
+        return Ok(None);
+    }
+
+    let offsets = offsets
+        .cast(DType::Primitive(PType::U64, Nullability::NonNullable))?
+        .execute::<PrimitiveArray>(ctx)?;
+    let offsets = offsets.as_slice::<u64>();
+    let parent_mask = validity.execute_mask(len, ctx)?;
+    let mut mask = Vec::with_capacity(elements.len());
+    for row in 0..len {
+        let start = usize_offset(offsets[row])?;
+        let end = usize_offset(offsets[row + 1])?;
+        vortex_ensure!(
+            end <= elements.len(),
+            "list offset {end} exceeds elements length {}",
+            elements.len()
+        );
+        mask.extend(std::iter::repeat_n(parent_mask.value(row), end - start));
+    }
+    debug_assert_eq!(mask.len(), elements.len());
+    Ok(Some(BoolArray::from_iter(mask).into_array()))
+}
+
+fn list_view_element_mask(
+    lambda: &LambdaCall,
+    elements: &ArrayRef,
+    offsets: &ArrayRef,
+    sizes: &ArrayRef,
+    validity: &Validity,
+    len: usize,
+    ctx: &mut crate::ExecutionCtx,
+) -> VortexResult<Option<ArrayRef>> {
+    if !requires_element_mask(lambda, elements) {
+        return Ok(None);
+    }
+
+    let dtype = DType::Primitive(PType::U64, Nullability::NonNullable);
+    let offsets = offsets
+        .cast(dtype.clone())?
+        .execute::<PrimitiveArray>(ctx)?;
+    let sizes = sizes.cast(dtype)?.execute::<PrimitiveArray>(ctx)?;
+    let offsets = offsets.as_slice::<u64>();
+    let sizes = sizes.as_slice::<u64>();
+    let parent_mask = validity.execute_mask(len, ctx)?;
+    let mut mask = vec![false; elements.len()];
+    for row in 0..len {
+        if parent_mask.value(row) {
+            let start = usize_offset(offsets[row])?;
+            let size = usize_offset(sizes[row])?;
+            let end = start
+                .checked_add(size)
+                .ok_or_else(|| vortex_err!("list view range overflow"))?;
+            vortex_ensure!(
+                end <= elements.len(),
+                "list view range {start}..{end} exceeds elements length {}",
+                elements.len()
+            );
+            mask[start..end].fill(true);
+        }
+    }
+    Ok(Some(BoolArray::from_iter(mask).into_array()))
+}
+
+fn usize_offset(offset: u64) -> VortexResult<usize> {
+    usize::try_from(offset).map_err(|_| vortex_err!("offset {offset} does not fit in usize"))
+}
+
+/// Gather elements referenced by valid lists into a dense `List` layout.
+///
+/// Captures live at list-row granularity, while lambda parameters live at element granularity.
+/// `ListView` can also leave gaps in its element array, so its referenced ranges are gathered
+/// before captures are rebased to the lambda's elements.
+fn gather_referenced_elements(
+    elements: &ArrayRef,
+    offsets: &ArrayRef,
+    sizes: Option<&ArrayRef>,
+    validity: &Validity,
+    len: usize,
+    ctx: &mut crate::ExecutionCtx,
+) -> VortexResult<(ArrayRef, ArrayRef, ArrayRef)> {
+    let u64_dtype = DType::Primitive(PType::U64, Nullability::NonNullable);
+    let offsets = offsets
+        .cast(u64_dtype.clone())?
+        .execute::<PrimitiveArray>(ctx)?;
+    let offsets = offsets.as_slice::<u64>();
+    let sizes = sizes
+        .map(|sizes| sizes.cast(u64_dtype)?.execute::<PrimitiveArray>(ctx))
+        .transpose()?;
+    let sizes = sizes.as_ref().map(|sizes| sizes.as_slice::<u64>());
+
+    let mask = validity.execute_mask(len, ctx)?;
+    let mut indices = BufferMut::<u64>::empty();
+    let mut parent_indices = BufferMut::<u64>::empty();
+    let mut new_offsets = BufferMut::<u64>::with_capacity(len + 1);
+    new_offsets.push(0);
+    for row in 0..len {
+        if mask.value(row) {
+            let start = offsets[row];
+            let end = match sizes {
+                Some(sizes) => start + sizes[row],
+                None => offsets[row + 1],
+            };
+            for index in start..end {
+                indices.push(index);
+                parent_indices.push(row as u64);
+            }
+        }
+        new_offsets.push(indices.len() as u64);
+    }
+
+    Ok((
+        elements.take(indices.freeze().into_array())?,
+        new_offsets.freeze().into_array(),
+        parent_indices.freeze().into_array(),
+    ))
+}
+
+fn fixed_size_list_parent_indices(list_size: usize, len: usize) -> ArrayRef {
+    let mut indices = BufferMut::<u64>::with_capacity(list_size * len);
+    for row in 0..len {
+        indices.extend(std::iter::repeat_n(row as u64, list_size));
+    }
+    indices.freeze().into_array()
+}
+
+/// Matches a concrete variable- or fixed-size list encoding.
+struct AnyList;
+
+impl Matcher for AnyList {
+    type Match<'a> = ();
+
+    fn try_match(array: &ArrayRef) -> Option<Self::Match<'_>> {
+        (array.as_opt::<List>().is_some()
+            || array.as_opt::<ListView>().is_some()
+            || array.as_opt::<FixedSizeList>().is_some())
+        .then_some(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use vortex_buffer::buffer;
+    use vortex_error::VortexResult;
+
+    use super::*;
+    use crate::IntoArray;
+    use crate::VortexSessionExecute;
+    use crate::array_session;
+    use crate::arrays::BoolArray;
+    use crate::arrays::ListArray;
+    use crate::arrays::PrimitiveArray;
+    use crate::arrays::ScalarFn;
+    use crate::arrays::StructArray;
+    use crate::assert_arrays_eq;
+    use crate::dtype::FieldNames;
+    use crate::expr::Expression;
+    use crate::expr::cast;
+    use crate::expr::checked_add;
+    use crate::expr::col;
+    use crate::expr::lambda as lambda_expr;
+    use crate::expr::list_length;
+    use crate::expr::list_transform;
+    use crate::expr::lit;
+    use crate::expr::not;
+    use crate::expr::proto::ExprSerializeProtoExt;
+    use crate::expr::root;
+    use crate::expr::var;
+    use crate::validity::Validity;
+
+    #[test]
+    fn lowers_to_a_list_with_scalar_function_elements() -> VortexResult<()> {
+        let input = ListArray::try_new(
+            PrimitiveArray::from_iter([1_i32, 2, 3]).into_array(),
+            buffer![0_u32, 2, 3].into_array(),
+            Validity::NonNullable,
+        )?
+        .into_array();
+        let expression = list_transform(
+            root(),
+            lambda_expr(["element"], checked_add(var("element"), lit(1_i32)))?,
+        )?;
+
+        let mut ctx = array_session().create_execution_ctx();
+        let result = input.apply_with_ctx(&expression, &mut ctx)?;
+        assert!(result.is::<List>());
+        assert!(result.as_::<List>().elements().is::<ScalarFn>());
+        let expected = ListArray::try_new(
+            PrimitiveArray::from_iter([2_i32, 3, 4]).into_array(),
+            buffer![0_u32, 2, 3].into_array(),
+            Validity::NonNullable,
+        )?
+        .into_array();
+        assert_arrays_eq!(result, expected, &mut ctx);
+        Ok(())
+    }
+
+    #[test]
+    fn preserves_a_fixed_size_list_with_scalar_function_elements() -> VortexResult<()> {
+        let input = FixedSizeListArray::new(
+            PrimitiveArray::from_iter([1_i32, 2, 3, 4]).into_array(),
+            2,
+            Validity::NonNullable,
+            2,
+        )
+        .into_array();
+        let expression = list_transform(
+            root(),
+            lambda_expr(["element"], checked_add(var("element"), lit(1_i32)))?,
+        )?;
+
+        let result = input.apply(&expression)?;
+        assert!(result.is::<FixedSizeList>());
+        assert!(result.as_::<FixedSizeList>().elements().is::<ScalarFn>());
+        let expected = FixedSizeListArray::new(
+            PrimitiveArray::from_iter([2_i32, 3, 4, 5]).into_array(),
+            2,
+            Validity::NonNullable,
+            2,
+        )
+        .into_array();
+        let mut ctx = array_session().create_execution_ctx();
+        assert_arrays_eq!(result, expected, &mut ctx);
+        Ok(())
+    }
+
+    #[test]
+    fn masks_garbage_elements_of_null_fixed_size_lists() -> VortexResult<()> {
+        let input = FixedSizeListArray::new(
+            PrimitiveArray::from_iter([i32::MAX, i32::MAX, 1, 2]).into_array(),
+            2,
+            Validity::from_iter([false, true]),
+            2,
+        )
+        .into_array();
+        let expression = list_transform(
+            root(),
+            lambda_expr(["element"], checked_add(var("element"), lit(1_i32)))?,
+        )?;
+
+        let result = input.apply(&expression)?;
+        assert!(result.is::<FixedSizeList>());
+        assert!(result.as_::<FixedSizeList>().elements().is::<ScalarFn>());
+        let expected = FixedSizeListArray::new(
+            PrimitiveArray::from_option_iter([None, None, Some(2_i32), Some(3)]).into_array(),
+            2,
+            Validity::from_iter([false, true]),
+            2,
+        )
+        .into_array();
+        let mut ctx = array_session().create_execution_ctx();
+        assert_arrays_eq!(result, expected, &mut ctx);
+        Ok(())
+    }
+
+    #[test]
+    fn lowers_a_list_column_to_scalar_function_elements() -> VortexResult<()> {
+        let lists = ListArray::try_new(
+            PrimitiveArray::from_iter([1_i32, 2, 3]).into_array(),
+            buffer![0_u32, 2, 3].into_array(),
+            Validity::NonNullable,
+        )?
+        .into_array();
+        let input = StructArray::try_new(
+            FieldNames::from(["lists"]),
+            vec![lists],
+            2,
+            Validity::NonNullable,
+        )?
+        .into_array();
+        let expression = list_transform(
+            col("lists"),
+            lambda_expr(["element"], checked_add(var("element"), lit(1_i32)))?,
+        )?;
+
+        let result = input.apply(&expression)?;
+        assert!(result.is::<List>());
+        assert!(result.as_::<List>().elements().is::<ScalarFn>());
+        let expected = ListArray::try_new(
+            PrimitiveArray::from_iter([2_i32, 3, 4]).into_array(),
+            buffer![0_u32, 2, 3].into_array(),
+            Validity::NonNullable,
+        )?
+        .into_array();
+        let mut ctx = array_session().create_execution_ctx();
+        assert_arrays_eq!(result, expected, &mut ctx);
+        Ok(())
+    }
+
+    #[test]
+    fn preserves_a_list_view_with_scalar_function_elements() -> VortexResult<()> {
+        let input = ListViewArray::new(
+            BoolArray::from_iter([true, false, true, false]).into_array(),
+            buffer![2_u32, 0].into_array(),
+            buffer![2_u32, 2].into_array(),
+            Validity::NonNullable,
+        )
+        .into_array();
+        assert!(input.is::<ListView>());
+        let expression = list_transform(root(), lambda_expr(["element"], not(var("element")))?)?;
+
+        let result = input.apply(&expression)?;
+        assert!(
+            result.is::<ListView>(),
+            "expected a ListView result, got {}",
+            result.encoding_id()
+        );
+        assert!(result.as_::<ListView>().elements().is::<ScalarFn>());
+        let expected = ListViewArray::new(
+            BoolArray::from_iter([false, true, false, true]).into_array(),
+            buffer![2_u32, 0].into_array(),
+            buffer![2_u32, 2].into_array(),
+            Validity::NonNullable,
+        )
+        .into_array();
+        let mut ctx = array_session().create_execution_ctx();
+        assert_arrays_eq!(result, expected, &mut ctx);
+        Ok(())
+    }
+
+    #[test]
+    fn masks_garbage_elements_of_null_list_views() -> VortexResult<()> {
+        let input = ListViewArray::new(
+            PrimitiveArray::from_iter([i32::MAX, i32::MAX, 1, 2]).into_array(),
+            buffer![2_u32, 0].into_array(),
+            buffer![2_u32, 2].into_array(),
+            Validity::from_iter([true, false]),
+        )
+        .into_array();
+        let expression = list_transform(
+            root(),
+            lambda_expr(["element"], checked_add(var("element"), lit(1_i32)))?,
+        )?;
+
+        let result = input.apply(&expression)?;
+        assert!(result.is::<ListView>());
+        assert!(result.as_::<ListView>().elements().is::<ScalarFn>());
+        let expected = ListViewArray::new(
+            PrimitiveArray::from_option_iter([None, None, Some(2_i32), Some(3)]).into_array(),
+            buffer![2_u32, 0].into_array(),
+            buffer![2_u32, 2].into_array(),
+            Validity::from_iter([true, false]),
+        )
+        .into_array();
+        let mut ctx = array_session().create_execution_ctx();
+        assert_arrays_eq!(result, expected, &mut ctx);
+        Ok(())
+    }
+
+    #[test]
+    fn rejects_a_lambda_with_the_wrong_arity() -> VortexResult<()> {
+        let expression = list_transform(root(), lambda_expr(["x", "i"], var("x"))?)?;
+        let dtype = DType::List(
+            std::sync::Arc::new(DType::Primitive(PType::I32, Nullability::NonNullable)),
+            Nullability::NonNullable,
+        );
+        assert!(expression.return_dtype(&dtype).is_err());
+        Ok(())
+    }
+
+    #[test]
+    fn nested_transforms_capture_outer_parameters() -> VortexResult<()> {
+        let inner_lists = ListArray::try_new(
+            PrimitiveArray::from_iter([1_i32, 2, 3, 4]).into_array(),
+            buffer![0_u32, 2, 3, 4].into_array(),
+            Validity::NonNullable,
+        )?
+        .into_array();
+        let input = ListArray::try_new(
+            inner_lists,
+            buffer![0_u32, 2, 3].into_array(),
+            Validity::NonNullable,
+        )?
+        .into_array();
+
+        let inner = list_transform(
+            var("outer"),
+            lambda_expr(
+                ["inner"],
+                checked_add(
+                    var("inner"),
+                    cast(
+                        list_length(var("outer")),
+                        DType::Primitive(PType::I32, Nullability::NonNullable),
+                    ),
+                ),
+            )?,
+        )?;
+        let expression = list_transform(root(), lambda_expr(["outer"], inner)?)?;
+
+        let result = input.apply(&expression)?;
+        let expected_inner_lists = ListArray::try_new(
+            PrimitiveArray::from_iter([3_i32, 4, 4, 5]).into_array(),
+            buffer![0_u32, 2, 3, 4].into_array(),
+            Validity::NonNullable,
+        )?
+        .into_array();
+        let expected = ListArray::try_new(
+            expected_inner_lists,
+            buffer![0_u32, 2, 3].into_array(),
+            Validity::NonNullable,
+        )?
+        .into_array();
+        let mut ctx = array_session().create_execution_ctx();
+        assert_arrays_eq!(result, expected, &mut ctx);
+        Ok(())
+    }
+
+    #[test]
+    fn inner_parameters_shadow_outer_parameters() -> VortexResult<()> {
+        let inner_lists = ListArray::try_new(
+            PrimitiveArray::from_iter([1_i32, 2, 3, 4]).into_array(),
+            buffer![0_u32, 2, 3, 4].into_array(),
+            Validity::NonNullable,
+        )?
+        .into_array();
+        let input = ListArray::try_new(
+            inner_lists,
+            buffer![0_u32, 2, 3].into_array(),
+            Validity::NonNullable,
+        )?
+        .into_array();
+
+        let inner = list_transform(
+            var("value"),
+            lambda_expr(["value"], checked_add(var("value"), lit(1_i32)))?,
+        )?;
+        let expression = list_transform(root(), lambda_expr(["value"], inner)?)?;
+
+        let result = input.apply(&expression)?;
+        let expected_inner_lists = ListArray::try_new(
+            PrimitiveArray::from_iter([2_i32, 3, 4, 5]).into_array(),
+            buffer![0_u32, 2, 3, 4].into_array(),
+            Validity::NonNullable,
+        )?
+        .into_array();
+        let expected = ListArray::try_new(
+            expected_inner_lists,
+            buffer![0_u32, 2, 3].into_array(),
+            Validity::NonNullable,
+        )?
+        .into_array();
+        let mut ctx = array_session().create_execution_ctx();
+        assert_arrays_eq!(result, expected, &mut ctx);
+        Ok(())
+    }
+
+    #[test]
+    fn masks_garbage_elements_of_null_lists_before_lambda_application() -> VortexResult<()> {
+        let input = ListArray::try_new(
+            PrimitiveArray::from_iter([1_i32, i32::MAX]).into_array(),
+            buffer![0_u32, 1, 2].into_array(),
+            Validity::Array(BoolArray::from_iter([true, false]).into_array()),
+        )?
+        .into_array();
+        let expression = list_transform(
+            root(),
+            lambda_expr(["element"], checked_add(var("element"), lit(1_i32)))?,
+        )?;
+
+        let result = input.apply(&expression)?;
+        assert!(result.is::<List>());
+        assert!(result.as_::<List>().elements().is::<ScalarFn>());
+        let expected = ListArray::try_new(
+            PrimitiveArray::from_option_iter([Some(2_i32), None]).into_array(),
+            buffer![0_u32, 1, 2].into_array(),
+            Validity::Array(BoolArray::from_iter([true, false]).into_array()),
+        )?
+        .into_array();
+        let mut ctx = array_session().create_execution_ctx();
+        assert_arrays_eq!(result, expected, &mut ctx);
+        Ok(())
+    }
+
+    #[test]
+    fn higher_order_expression_round_trips() -> VortexResult<()> {
+        let expression = list_transform(
+            root(),
+            lambda_expr(["element"], checked_add(var("element"), lit(1_i32)))?,
+        )?;
+        let session = array_session();
+
+        let round_tripped = Expression::from_proto(&expression.serialize_proto()?, &session)?;
+        assert_eq!(round_tripped, expression);
+        Ok(())
+    }
+
+    #[test]
+    fn nested_higher_order_expression_round_trips() -> VortexResult<()> {
+        let inner = list_transform(
+            var("outer"),
+            lambda_expr(["inner"], checked_add(var("inner"), lit(1_i32)))?,
+        )?;
+        let expression = list_transform(root(), lambda_expr(["outer"], inner)?)?;
+        let session = array_session();
+
+        let round_tripped = Expression::from_proto(&expression.serialize_proto()?, &session)?;
+        assert_eq!(round_tripped, expression);
+        Ok(())
+    }
+}
diff --git a/vortex-array/src/higher_order_fn/fns/mod.rs b/vortex-array/src/higher_order_fn/fns/mod.rs
new file mode 100644
index 00000000000..3fe3265ccc0
--- /dev/null
+++ b/vortex-array/src/higher_order_fn/fns/mod.rs
@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: Copyright the Vortex contributors
+
+pub mod list_transform;
diff --git a/vortex-array/src/higher_order_fn/lambda.rs b/vortex-array/src/higher_order_fn/lambda.rs
new file mode 100644
index 00000000000..34ffec12894
--- /dev/null
+++ b/vortex-array/src/higher_order_fn/lambda.rs
@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: Copyright the Vortex contributors
+
+use vortex_error::VortexResult;
+use vortex_utils::aliases::hash_map::HashMap;
+
+use crate::ArrayRef;
+use crate::ExecutionCtx;
+use crate::expr::BoundLambda;
+use crate::expr::VariableRef;
+use crate::expression::ApplyCtx;
+
+/// A closed lambda ready to be applied in a higher-order function's invocation domain.
+///
+/// Captures are ordinary arrays rather than slots in a dedicated higher-order-function array.
+/// A higher-order function rebases them into its invocation domain before applying the scalar
+/// expression body.
+#[derive(Clone, Debug)]
+pub struct LambdaCall {
+    lambda: BoundLambda,
+    captures: Vec<(VariableRef, ArrayRef)>,
+}
+
+impl LambdaCall {
+    pub(crate) fn new(lambda: BoundLambda, captures: Vec<(VariableRef, ArrayRef)>) -> Self {
+        Self { lambda, captures }
+    }
+
+    /// The bound lambda expression being invoked.
+    pub fn lambda(&self) -> &BoundLambda {
+        &self.lambda
+    }
+
+    /// Whether this lambda reads any enclosing lexical binding.
+    pub fn has_captures(&self) -> bool {
+        !self.captures.is_empty()
+    }
+
+    /// Apply the lambda to arrays in its invocation domain.
+    ///
+    /// When `parent_indices` is provided, it maps the invocation rows to the rows of the captured
+    /// arrays. A list function, for example, can use it to map flattened element rows back to
+    /// their parent list rows before applying the lambda body.
+    pub fn apply(
+        &self,
+        root: ArrayRef,
+        args: &[ArrayRef],
+        parent_indices: Option<&ArrayRef>,
+        execution_ctx: &mut ExecutionCtx,
+    ) -> VortexResult<ArrayRef> {
+        self.lambda.validate_arguments(&root, args)?;
+
+        let mut bindings = HashMap::new();
+        for (variable_ref, array) in &self.captures {
+            let array = match parent_indices {
+                Some(indices) => array.take(indices.clone())?,
+                None => array.clone(),
+            };
+            bindings.insert(*variable_ref, array);
+        }
+        for (variable_ref, array) in self.lambda.param_refs().iter().zip(args) {
+            bindings.insert(*variable_ref, array.clone());
+        }
+
+        self.lambda
+            .body()
+            .apply(&mut ApplyCtx::with_bindings(root, bindings, execution_ctx))
+    }
+}
diff --git a/vortex-array/src/higher_order_fn/mod.rs b/vortex-array/src/higher_order_fn/mod.rs
new file mode 100644
index 00000000000..4c07210b1e7
--- /dev/null
+++ b/vortex-array/src/higher_order_fn/mod.rs
@@ -0,0 +1,34 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: Copyright the Vortex contributors
+
+//! Higher-order function vtable machinery.
+//!
+//! Higher-order functions combine ordinary expression children with lambdas. They are distinct
+//! from scalar functions because they establish lambda parameter types and evaluation bindings.
+
+use vortex_session::registry::Id;
+
+mod erased;
+pub use erased::HigherOrderFunctionRef;
+
+mod options;
+pub use options::HigherOrderFunctionOptions;
+
+mod typed;
+pub use typed::TypedHigherOrderFunctionInstance;
+
+mod lambda;
+pub use lambda::LambdaCall;
+
+mod plugin;
+pub use plugin::*;
+
+pub mod session;
+
+mod vtable;
+pub use vtable::*;
+
+pub mod fns;
+
+/// A globally unique identifier for a higher-order function.
+pub type HigherOrderFunctionId = Id;
diff --git a/vortex-array/src/higher_order_fn/options.rs b/vortex-array/src/higher_order_fn/options.rs
new file mode 100644
index 00000000000..b1c6f9bef4f
--- /dev/null
+++ b/vortex-array/src/higher_order_fn/options.rs
@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: Copyright the Vortex contributors
+
+use std::any::Any;
+use std::fmt::Debug;
+use std::fmt::Display;
+use std::hash::Hash;
+use std::hash::Hasher;
+
+use vortex_error::VortexResult;
+
+use crate::higher_order_fn::typed::DynHigherOrderFunction;
+
+/// An opaque handle to the options of a higher-order function.
+pub struct HigherOrderFunctionOptions<'a> {
+    pub(super) inner: &'a dyn DynHigherOrderFunction,
+}
+
+impl Display for HigherOrderFunctionOptions<'_> {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        self.inner.options_display(f)
+    }
+}
+
+impl Debug for HigherOrderFunctionOptions<'_> {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        self.inner.options_debug(f)
+    }
+}
+
+impl PartialEq for HigherOrderFunctionOptions<'_> {
+    fn eq(&self, other: &Self) -> bool {
+        self.inner.id() == other.inner.id() && self.inner.options_eq(other.inner.options_any())
+    }
+}
+
+impl Eq for HigherOrderFunctionOptions<'_> {}
+
+impl Hash for HigherOrderFunctionOptions<'_> {
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        self.inner.id().hash(state);
+        self.inner.options_hash(state);
+    }
+}
+
+impl HigherOrderFunctionOptions<'_> {
+    /// Serialize these options to a byte vector.
+    pub fn serialize(&self) -> VortexResult<Option<Vec<u8>>> {
+        self.inner.options_serialize()
+    }
+
+    /// Return the underlying typed options as [`Any`].
+    pub fn as_any(&self) -> &dyn Any {
+        self.inner.options_any()
+    }
+}
diff --git a/vortex-array/src/higher_order_fn/plugin.rs b/vortex-array/src/higher_order_fn/plugin.rs
new file mode 100644
index 00000000000..487877c4c70
--- /dev/null
+++ b/vortex-array/src/higher_order_fn/plugin.rs
@@ -0,0 +1,47 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: Copyright the Vortex contributors
+
+use std::sync::Arc;
+
+use vortex_error::VortexResult;
+use vortex_session::VortexSession;
+
+use crate::higher_order_fn::HigherOrderFunctionId;
+use crate::higher_order_fn::HigherOrderFunctionRef;
+use crate::higher_order_fn::HigherOrderFunctionVTable;
+use crate::higher_order_fn::TypedHigherOrderFunctionInstance;
+
+/// A session-registered higher-order-function vtable.
+pub trait HigherOrderFunctionPlugin: 'static + Send + Sync {
+    fn id(&self) -> HigherOrderFunctionId;
+    fn deserialize(
+        &self,
+        metadata: &[u8],
+        session: &VortexSession,
+    ) -> VortexResult<HigherOrderFunctionRef>;
+}
+
+impl std::fmt::Debug for dyn HigherOrderFunctionPlugin {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_tuple("HigherOrderFunctionPlugin")
+            .field(&self.id())
+            .finish()
+    }
+}
+
+impl<V: HigherOrderFunctionVTable> HigherOrderFunctionPlugin for V {
+    fn id(&self) -> HigherOrderFunctionId {
+        V::id(self)
+    }
+
+    fn deserialize(
+        &self,
+        metadata: &[u8],
+        session: &VortexSession,
+    ) -> VortexResult<HigherOrderFunctionRef> {
+        let options = HigherOrderFunctionVTable::deserialize(self, metadata, session)?;
+        Ok(TypedHigherOrderFunctionInstance::new(self.clone(), options).erased())
+    }
+}
+
+pub type HigherOrderFunctionPluginRef = Arc<dyn HigherOrderFunctionPlugin>;
diff --git a/vortex-array/src/higher_order_fn/session.rs b/vortex-array/src/higher_order_fn/session.rs
new file mode 100644
index 00000000000..6beffe5c96d
--- /dev/null
+++ b/vortex-array/src/higher_order_fn/session.rs
@@ -0,0 +1,64 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: Copyright the Vortex contributors
+
+use std::any::Any;
+use std::sync::Arc;
+
+use vortex_session::ArcSwapMap;
+use vortex_session::SessionExt;
+use vortex_session::SessionGuard;
+use vortex_session::SessionVar;
+use vortex_session::registry::Id;
+
+use crate::higher_order_fn::HigherOrderFunctionPluginRef;
+use crate::higher_order_fn::HigherOrderFunctionVTable;
+use crate::higher_order_fn::fns::list_transform::ListTransform;
+
+/// Registry of higher-order function vtables.
+pub type HigherOrderFunctionRegistry = ArcSwapMap<Id, HigherOrderFunctionPluginRef>;
+
+/// Session state for higher-order function vtables.
+#[derive(Clone, Debug)]
+pub struct HigherOrderFunctionSession {
+    registry: HigherOrderFunctionRegistry,
+}
+
+impl HigherOrderFunctionSession {
+    pub fn registry(&self) -> &HigherOrderFunctionRegistry {
+        &self.registry
+    }
+
+    /// Register a vtable, replacing any existing vtable with the same ID.
+    pub fn register<V: HigherOrderFunctionVTable>(&self, vtable: V) {
+        self.registry.insert(vtable.id(), Arc::new(vtable));
+    }
+}
+
+impl Default for HigherOrderFunctionSession {
+    fn default() -> Self {
+        let this = Self {
+            registry: HigherOrderFunctionRegistry::default(),
+        };
+        this.register(ListTransform);
+        this
+    }
+}
+
+impl SessionVar for HigherOrderFunctionSession {
+    fn as_any(&self) -> &dyn Any {
+        self
+    }
+
+    fn as_any_mut(&mut self) -> &mut dyn Any {
+        self
+    }
+}
+
+/// Extension trait for accessing higher-order-function session state.
+pub trait HigherOrderFunctionSessionExt: SessionExt {
+    fn higher_order_functions(&self) -> SessionGuard<'_, HigherOrderFunctionSession> {
+        self.get::<HigherOrderFunctionSession>()
+    }
+}
+
+impl<S: SessionExt> HigherOrderFunctionSessionExt for S {}
diff --git a/vortex-array/src/higher_order_fn/typed.rs b/vortex-array/src/higher_order_fn/typed.rs
new file mode 100644
index 00000000000..3c6cf2ea44d
--- /dev/null
+++ b/vortex-array/src/higher_order_fn/typed.rs
@@ -0,0 +1,170 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: Copyright the Vortex contributors
+
+use std::any::Any;
+use std::fmt;
+use std::fmt::Debug;
+use std::fmt::Display;
+use std::fmt::Formatter;
+use std::hash::Hasher;
+use std::sync::Arc;
+
+use vortex_error::VortexResult;
+
+use crate::ArrayRef;
+use crate::ExecutionCtx;
+use crate::dtype::DType;
+use crate::expr::BoundLambdaArgs;
+use crate::expr::Lambda;
+use crate::expr::display::HigherOrderExprDisplay;
+use crate::higher_order_fn::HigherOrderFunctionId;
+use crate::higher_order_fn::HigherOrderFunctionRef;
+use crate::higher_order_fn::HigherOrderFunctionVTable;
+use crate::higher_order_fn::LambdaCall;
+use crate::higher_order_fn::LambdaSignature;
+use crate::scalar_fn::Arity;
+use crate::scalar_fn::ChildName;
+use crate::validity::Validity;
+
+/// A typed higher-order-function instance, pairing a vtable with its per-call options.
+pub struct TypedHigherOrderFunctionInstance<V: HigherOrderFunctionVTable> {
+    vtable: V,
+    options: V::Options,
+}
+
+impl<V: HigherOrderFunctionVTable> TypedHigherOrderFunctionInstance<V> {
+    /// Create a typed higher-order-function instance.
+    pub fn new(vtable: V, options: V::Options) -> Self {
+        Self { vtable, options }
+    }
+
+    /// Return the vtable.
+    pub fn vtable(&self) -> &V {
+        &self.vtable
+    }
+
+    /// Return the typed options.
+    pub fn options(&self) -> &V::Options {
+        &self.options
+    }
+
+    /// Erase the concrete type information.
+    pub fn erased(self) -> HigherOrderFunctionRef {
+        HigherOrderFunctionRef(Arc::new(self))
+    }
+}
+
+pub(super) trait DynHigherOrderFunction: 'static + Send + Sync {
+    fn as_any(&self) -> &dyn Any;
+    fn id(&self) -> HigherOrderFunctionId;
+    fn options_any(&self) -> &dyn Any;
+    fn arity(&self) -> Arity;
+    fn lambda_arity(&self) -> usize;
+    fn child_name(&self, child_idx: usize) -> ChildName;
+    fn coerce_input_args(&self, args: &[DType]) -> VortexResult<Vec<DType>>;
+    fn lambda_signatures(
+        &self,
+        arg_dtypes: &[DType],
+        lambdas: &[&Lambda],
+    ) -> VortexResult<Box<[LambdaSignature]>>;
+    fn return_dtype(&self, args: &[DType], lambdas: BoundLambdaArgs<'_>) -> VortexResult<DType>;
+    fn validity(&self, args: &[ArrayRef], lambdas: BoundLambdaArgs<'_>) -> VortexResult<Validity>;
+    fn apply(
+        &self,
+        args: &[ArrayRef],
+        lambdas: &[LambdaCall],
+        execution_ctx: &mut ExecutionCtx,
+    ) -> VortexResult<ArrayRef>;
+    fn is_fallible(&self, lambdas: BoundLambdaArgs<'_>) -> bool;
+    fn fmt_sql(&self, expr: &dyn HigherOrderExprDisplay, f: &mut Formatter<'_>) -> fmt::Result;
+    fn options_serialize(&self) -> VortexResult<Option<Vec<u8>>>;
+    fn options_eq(&self, other_options: &dyn Any) -> bool;
+    fn options_hash(&self, hasher: &mut dyn Hasher);
+    fn options_display(&self, f: &mut Formatter<'_>) -> fmt::Result;
+    fn options_debug(&self, f: &mut Formatter<'_>) -> fmt::Result;
+}
+
+impl<V: HigherOrderFunctionVTable> DynHigherOrderFunction for TypedHigherOrderFunctionInstance<V> {
+    fn as_any(&self) -> &dyn Any {
+        self
+    }
+
+    fn id(&self) -> HigherOrderFunctionId {
+        V::id(&self.vtable)
+    }
+
+    fn options_any(&self) -> &dyn Any {
+        &self.options
+    }
+
+    fn arity(&self) -> Arity {
+        V::arity(&self.vtable, &self.options)
+    }
+
+    fn lambda_arity(&self) -> usize {
+        V::lambda_arity(&self.vtable, &self.options)
+    }
+
+    fn child_name(&self, child_idx: usize) -> ChildName {
+        V::child_name(&self.vtable, &self.options, child_idx)
+    }
+
+    fn coerce_input_args(&self, args: &[DType]) -> VortexResult<Vec<DType>> {
+        V::coerce_input_args(&self.vtable, &self.options, args)
+    }
+
+    fn lambda_signatures(
+        &self,
+        arg_dtypes: &[DType],
+        lambdas: &[&Lambda],
+    ) -> VortexResult<Box<[LambdaSignature]>> {
+        V::lambda_signatures(&self.vtable, &self.options, arg_dtypes, lambdas)
+    }
+
+    fn return_dtype(&self, args: &[DType], lambdas: BoundLambdaArgs<'_>) -> VortexResult<DType> {
+        V::return_dtype(&self.vtable, &self.options, args, lambdas)
+    }
+
+    fn validity(&self, args: &[ArrayRef], lambdas: BoundLambdaArgs<'_>) -> VortexResult<Validity> {
+        V::validity(&self.vtable, &self.options, args, lambdas)
+    }
+
+    fn apply(
+        &self,
+        args: &[ArrayRef],
+        lambdas: &[LambdaCall],
+        execution_ctx: &mut ExecutionCtx,
+    ) -> VortexResult<ArrayRef> {
+        V::apply(&self.vtable, &self.options, args, lambdas, execution_ctx)
+    }
+
+    fn is_fallible(&self, lambdas: BoundLambdaArgs<'_>) -> bool {
+        V::is_fallible(&self.vtable, &self.options, lambdas)
+    }
+
+    fn fmt_sql(&self, expr: &dyn HigherOrderExprDisplay, f: &mut Formatter<'_>) -> fmt::Result {
+        V::fmt_sql(&self.vtable, &self.options, expr, f)
+    }
+
+    fn options_serialize(&self) -> VortexResult<Option<Vec<u8>>> {
+        V::serialize(&self.vtable, &self.options)
+    }
+
+    fn options_eq(&self, other_options: &dyn Any) -> bool {
+        other_options
+            .downcast_ref::<V::Options>()
+            .is_some_and(|options| self.options == *options)
+    }
+
+    fn options_hash(&self, mut hasher: &mut dyn Hasher) {
+        std::hash::Hash::hash(&self.options, &mut hasher);
+    }
+
+    fn options_display(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        Display::fmt(&self.options, f)
+    }
+
+    fn options_debug(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        Debug::fmt(&self.options, f)
+    }
+}
diff --git a/vortex-array/src/higher_order_fn/vtable.rs b/vortex-array/src/higher_order_fn/vtable.rs
new file mode 100644
index 00000000000..02199b97ce4
--- /dev/null
+++ b/vortex-array/src/higher_order_fn/vtable.rs
@@ -0,0 +1,422 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: Copyright the Vortex contributors
+
+use std::fmt;
+use std::fmt::Debug;
+use std::fmt::Display;
+use std::fmt::Formatter;
+use std::hash::Hash;
+
+use vortex_error::VortexExpect;
+use vortex_error::VortexResult;
+use vortex_error::vortex_bail;
+use vortex_session::VortexSession;
+
+use crate::ArrayRef;
+use crate::ExecutionCtx;
+use crate::dtype::DType;
+use crate::expr::BoundLambda;
+use crate::expr::BoundLambdaArgs;
+use crate::expr::Frame;
+use crate::expr::Lambda;
+use crate::expr::Scope;
+use crate::expr::display::HigherOrderExprDisplay;
+use crate::higher_order_fn::HigherOrderFunctionId;
+use crate::higher_order_fn::HigherOrderFunctionRef;
+use crate::higher_order_fn::LambdaCall;
+use crate::higher_order_fn::TypedHigherOrderFunctionInstance;
+use crate::scalar_fn::Arity;
+use crate::scalar_fn::ChildName;
+use crate::validity::Validity;
+
+/// The implementation contract for a higher-order function.
+///
+/// Unlike a [`ScalarFnVTable`](crate::scalar_fn::ScalarFnVTable), a higher-order function owns
+/// one or more lambdas in addition to its ordinary expression children. It determines the lambda
+/// parameter types while binding, then receives the resulting [`BoundLambda`]s at execution.
+pub trait HigherOrderFunctionVTable: 'static + Sized + Clone + Send + Sync {
+    /// Per-call options for this higher-order function.
+    ///
+    /// Lambdas and their captures are owned by the expression, not by these options. Options
+    /// contain only declarative configuration of the higher-order function itself.
+    type Options: 'static + Send + Sync + Clone + Debug + Display + PartialEq + Eq + Hash;
+
+    /// The globally unique identifier for this higher-order function.
+    fn id(&self) -> HigherOrderFunctionId;
+
+    /// The arity of the ordinary expression children.
+    fn arity(&self, options: &Self::Options) -> Arity;
+
+    /// The number of lambda arguments.
+    fn lambda_arity(&self, options: &Self::Options) -> usize;
+
+    /// The name of an ordinary expression child.
+    fn child_name(&self, options: &Self::Options, child_idx: usize) -> ChildName;
+
+    /// Serialize the per-call options.
+    ///
+    /// The lambda syntax is serialized by [`Expression`](crate::expr::Expression), not here.
+    fn serialize(&self, options: &Self::Options) -> VortexResult<Option<Vec<u8>>> {
+        _ = options;
+        Ok(None)
+    }
+
+    /// Deserialize per-call options.
+    fn deserialize(
+        &self,
+        _metadata: &[u8],
+        _session: &VortexSession,
+    ) -> VortexResult<Self::Options> {
+        vortex_bail!("higher-order function {} is not deserializable", self.id());
+    }
+
+    /// Format an expression tree in a human-readable SQL-style format.
+    ///
+    /// The display exposes ordinary expression children separately from lambda arguments, so a
+    /// function may use a custom syntax for either kind. The default prints ordinary children,
+    /// then lambdas, followed by non-empty options.
+    fn fmt_sql(
+        &self,
+        options: &Self::Options,
+        expr: &dyn HigherOrderExprDisplay,
+        f: &mut Formatter<'_>,
+    ) -> fmt::Result {
+        write!(f, "{}(", self.id())?;
+        let mut wrote_argument = false;
+        for index in 0..expr.display_children_count() {
+            if wrote_argument {
+                write!(f, ", ")?;
+            }
+            Display::fmt(expr.display_child(index), f)?;
+            wrote_argument = true;
+        }
+        for index in 0..expr.display_lambdas_count() {
+            if wrote_argument {
+                write!(f, ", ")?;
+            }
+            Display::fmt(expr.display_lambda(index), f)?;
+            wrote_argument = true;
+        }
+        let options = options.to_string();
+        if !options.is_empty() {
+            if wrote_argument {
+                write!(f, ", ")?;
+            }
+            write!(f, "opts={options}")?;
+        }
+        write!(f, ")")
+    }
+
+    /// Coerce the ordinary input argument types for this higher-order function.
+    ///
+    /// Lambda bodies are not scalar children and are therefore deliberately excluded. Their
+    /// parameter types are established by [`Self::lambda_signatures`] after these input types have
+    /// been coerced.
+    fn coerce_input_args(
+        &self,
+        options: &Self::Options,
+        args: &[DType],
+    ) -> VortexResult<Vec<DType>> {
+        _ = options;
+        Ok(args.to_vec())
+    }
+
+    /// Return the binding signatures for `lambdas` after ordinary children have been bound.
+    ///
+    /// The generic expression binder uses each signature to establish the lambda's parameter frame
+    /// and root scope, then produces [`BoundLambda`] nodes. Keeping this declaration separate from
+    /// the binding walk also lets scoped rewrites optimize lambda bodies with the same scope.
+    fn lambda_signatures(
+        &self,
+        options: &Self::Options,
+        arg_dtypes: &[DType],
+        lambdas: &[&Lambda],
+    ) -> VortexResult<Box<[LambdaSignature]>>;
+
+    /// Return the dtype after both ordinary children and lambdas have been bound.
+    fn return_dtype(
+        &self,
+        options: &Self::Options,
+        arg_dtypes: &[DType],
+        lambdas: BoundLambdaArgs<'_>,
+    ) -> VortexResult<DType>;
+
+    /// Return the result validity without executing the function.
+    ///
+    /// Most functions only know that a nullable result is potentially valid everywhere, but a
+    /// function such as `list_transform` can preserve validity from one of its inputs exactly.
+    fn validity(
+        &self,
+        options: &Self::Options,
+        args: &[ArrayRef],
+        lambdas: BoundLambdaArgs<'_>,
+    ) -> VortexResult<Validity> {
+        let arg_dtypes = args
+            .iter()
+            .map(|arg| arg.dtype().clone())
+            .collect::<Vec<_>>();
+        Ok(Validity::from(
+            self.return_dtype(options, &arg_dtypes, lambdas)?
+                .nullability(),
+        ))
+    }
+
+    /// Lower the function over its already-applied ordinary arguments and closed lambdas.
+    ///
+    /// Lambdas build their bodies as normal scalar-function arrays. Implementations return an
+    /// ordinary array graph such as a rebuilt list array, not a dedicated HOF array encoding.
+    fn apply(
+        &self,
+        options: &Self::Options,
+        args: &[ArrayRef],
+        lambdas: &[LambdaCall],
+        execution_ctx: &mut ExecutionCtx,
+    ) -> VortexResult<ArrayRef>;
+
+    /// Whether evaluation of the function can raise a semantic error.
+    fn is_fallible(&self, options: &Self::Options, _lambdas: BoundLambdaArgs<'_>) -> bool {
+        _ = options;
+        true
+    }
+}
+
+/// The root and parameter dtypes a higher-order function assigns to one lambda argument.
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub struct LambdaSignature {
+    root_dtype: DType,
+    parameter_dtypes: Box<[DType]>,
+}
+
+impl LambdaSignature {
+    /// Create a lambda signature with its implicit root dtype and parameter dtypes.
+    pub fn new(root_dtype: DType, parameter_dtypes: impl Into<Box<[DType]>>) -> Self {
+        Self {
+            root_dtype,
+            parameter_dtypes: parameter_dtypes.into(),
+        }
+    }
+
+    /// The dtype to which [`crate::expr::root`] resolves in the lambda body.
+    pub fn root_dtype(&self) -> &DType {
+        &self.root_dtype
+    }
+
+    /// The parameter dtypes in declaration order.
+    pub fn parameter_dtypes(&self) -> &[DType] {
+        &self.parameter_dtypes
+    }
+
+    /// Construct this lambda's lexical scope from its parent scope and syntax.
+    pub fn scope(&self, lambda: &Lambda, parent: &Scope) -> VortexResult<Scope> {
+        vortex_error::vortex_ensure!(
+            lambda.params().len() == self.parameter_dtypes.len(),
+            "lambda takes {} parameters but its higher-order function supplied {} parameter types",
+            lambda.params().len(),
+            self.parameter_dtypes.len(),
+        );
+        let frame = Frame::try_new(
+            lambda
+                .params()
+                .iter()
+                .cloned()
+                .zip(self.parameter_dtypes.iter().cloned()),
+        )?;
+        Ok(parent.with_root(self.root_dtype.clone()).push_frame(frame))
+    }
+
+    /// Bind `lambda` in this signature's lexical scope.
+    pub fn bind(&self, lambda: &Lambda, parent: &Scope) -> VortexResult<BoundLambda> {
+        BoundLambda::bind(lambda, &self.scope(lambda, parent)?)
+    }
+}
+
+/// Empty higher-order-function options.
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub struct EmptyOptions;
+
+impl Display for EmptyOptions {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        f.write_str("")
+    }
+}
+
+/// Factory methods for higher-order function vtables.
+pub trait HigherOrderFunctionVTableExt: HigherOrderFunctionVTable {
+    /// Bind this vtable with the given options into a [`HigherOrderFunctionRef`].
+    fn bind(&self, options: Self::Options) -> HigherOrderFunctionRef {
+        TypedHigherOrderFunctionInstance::new(self.clone(), options).erased()
+    }
+
+    /// Create a higher-order expression from ordinary children and lambda syntax.
+    fn new_expr(
+        &self,
+        options: Self::Options,
+        children: impl IntoIterator<Item = crate::expr::Expression>,
+        lambdas: impl IntoIterator<Item = crate::expr::Expression>,
+    ) -> crate::expr::Expression {
+        Self::try_new_expr(self, options, children, lambdas)
+            .vortex_expect("failed to create higher-order expression")
+    }
+
+    /// Try to create a higher-order expression from ordinary children and lambda syntax.
+    fn try_new_expr(
+        &self,
+        options: Self::Options,
+        children: impl IntoIterator<Item = crate::expr::Expression>,
+        lambdas: impl IntoIterator<Item = crate::expr::Expression>,
+    ) -> VortexResult<crate::expr::Expression> {
+        crate::expr::Expression::try_new_higher_order(self.bind(options), children, lambdas)
+    }
+}
+
+impl<V: HigherOrderFunctionVTable> HigherOrderFunctionVTableExt for V {}
+
+#[cfg(test)]
+mod tests {
+    use std::fmt;
+    use std::fmt::Display;
+    use std::fmt::Formatter;
+
+    use vortex_error::VortexExpect;
+    use vortex_error::VortexResult;
+    use vortex_error::vortex_bail;
+    use vortex_session::registry::CachedId;
+
+    use super::*;
+    use crate::dtype::Nullability;
+    use crate::dtype::PType;
+    use crate::expr::lambda;
+    use crate::expr::root;
+    use crate::expr::transform::coerce_expression;
+    use crate::expr::var;
+
+    #[derive(Clone, Debug)]
+    struct TestHigherOrder;
+
+    #[derive(Clone, Debug, PartialEq, Eq, Hash)]
+    struct TestOptions(&'static str);
+
+    impl Display for TestOptions {
+        fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+            f.write_str(self.0)
+        }
+    }
+
+    impl HigherOrderFunctionVTable for TestHigherOrder {
+        type Options = TestOptions;
+
+        fn id(&self) -> HigherOrderFunctionId {
+            static ID: CachedId = CachedId::new("vortex.test.higher_order");
+            *ID
+        }
+
+        fn arity(&self, _options: &Self::Options) -> Arity {
+            Arity::Exact(1)
+        }
+
+        fn lambda_arity(&self, _options: &Self::Options) -> usize {
+            1
+        }
+
+        fn child_name(&self, _options: &Self::Options, _child_idx: usize) -> ChildName {
+            ChildName::from("input")
+        }
+
+        fn coerce_input_args(
+            &self,
+            _options: &Self::Options,
+            args: &[DType],
+        ) -> VortexResult<Vec<DType>> {
+            let [input] = args else {
+                vortex_bail!("test higher-order function expects one input");
+            };
+            Ok(vec![DType::Primitive(PType::I64, input.nullability())])
+        }
+
+        fn lambda_signatures(
+            &self,
+            _options: &Self::Options,
+            arg_dtypes: &[DType],
+            lambdas: &[&Lambda],
+        ) -> VortexResult<Box<[LambdaSignature]>> {
+            let [input] = arg_dtypes else {
+                vortex_bail!("test higher-order function expects one input");
+            };
+            let [_lambda] = lambdas else {
+                vortex_bail!("test higher-order function expects one lambda");
+            };
+            Ok(Box::new([LambdaSignature::new(
+                input.clone(),
+                [input.clone()],
+            )]))
+        }
+
+        fn return_dtype(
+            &self,
+            _options: &Self::Options,
+            arg_dtypes: &[DType],
+            _lambdas: BoundLambdaArgs<'_>,
+        ) -> VortexResult<DType> {
+            let [input] = arg_dtypes else {
+                vortex_bail!("test higher-order function expects one input");
+            };
+            Ok(input.clone())
+        }
+
+        fn apply(
+            &self,
+            _options: &Self::Options,
+            _args: &[ArrayRef],
+            _lambdas: &[LambdaCall],
+            _execution_ctx: &mut ExecutionCtx,
+        ) -> VortexResult<ArrayRef> {
+            vortex_bail!("test higher-order function is not executable")
+        }
+    }
+
+    #[test]
+    fn options_participate_in_sql_display_and_identity() -> VortexResult<()> {
+        let expr = TestHigherOrder.try_new_expr(
+            TestOptions("strategy=checked"),
+            [root()],
+            [lambda(["value"], var("value"))?],
+        )?;
+
+        assert_eq!(
+            expr.to_string(),
+            "vortex.test.higher_order($, (value) -> $value, opts=strategy=checked)"
+        );
+        assert_ne!(
+            TestHigherOrder.bind(TestOptions("left")),
+            TestHigherOrder.bind(TestOptions("right"))
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn coercion_applies_only_to_ordinary_higher_order_inputs() -> VortexResult<()> {
+        let expr = TestHigherOrder.try_new_expr(
+            TestOptions("strategy=checked"),
+            [crate::expr::lit(1_i32)],
+            [lambda(["value"], var("value"))?],
+        )?;
+
+        let coerced = coerce_expression(expr, &DType::Bool(Nullability::NonNullable))?;
+        assert_eq!(
+            coerced
+                .child(0)
+                .return_dtype(&DType::Bool(Nullability::NonNullable))?,
+            DType::Primitive(PType::I64, Nullability::NonNullable)
+        );
+        assert_eq!(coerced.lambdas()[0].to_string(), "(value) -> $value");
+        let bound = coerced.bind(&DType::Bool(Nullability::NonNullable))?;
+        let lambda = bound.lambdas()[0]
+            .as_lambda()
+            .vortex_expect("higher-order lambdas bind as lambda nodes");
+        assert_eq!(
+            lambda.param_dtypes(),
+            &[DType::Primitive(PType::I64, Nullability::NonNullable)]
+        );
+        Ok(())
+    }
+}
diff --git a/vortex-array/src/lib.rs b/vortex-array/src/lib.rs
index 9439dc7dd1b..4284a98acf9 100644
--- a/vortex-array/src/lib.rs
+++ b/vortex-array/src/lib.rs
@@ -96,6 +96,7 @@ use vortex_session::registry::Interner;
 
 use crate::aggregate_fn::session::AggregateFnSession;
 use crate::dtype::session::DTypeSession;
+use crate::higher_order_fn::session::HigherOrderFunctionSession;
 use crate::memory::MemorySession;
 use crate::optimizer::kernels::KernelSession;
 use crate::scalar_fn::session::ScalarFnSession;
@@ -119,9 +120,10 @@ pub mod display;
 pub mod dtype;
 mod executor;
 pub mod expr;
-mod expression;
+pub(crate) mod expression;
 pub mod extension;
 mod hash;
+pub mod higher_order_fn;
 pub mod iter;
 pub mod kernel;
 pub mod mask;
@@ -175,6 +177,7 @@ pub fn array_session() -> VortexSession {
         .with::<KernelSession>()
         .with::<DTypeSession>()
         .with::<ScalarFnSession>()
+        .with::<HigherOrderFunctionSession>()
         .with::<StatsSession>()
         .with::<AggregateFnSession>()
         .with::<MemorySession>()
diff --git a/vortex-proto/proto/expr.proto b/vortex-proto/proto/expr.proto
index 00ffaac433c..482bb204475 100644
--- a/vortex-proto/proto/expr.proto
+++ b/vortex-proto/proto/expr.proto
@@ -125,3 +125,13 @@ message SelectOpts {
 message CaseWhenOpts {
   uint32 num_children = 1;
 }
+
+// Options for `vortex.var`, a reference to a name bound in an enclosing scope.
+message VariableOpts {
+  string name = 1;
+}
+
+// Options for `vortex.lambda`. The body is the expression's single child.
+message LambdaOpts {
+  repeated string params = 1;
+}
diff --git a/vortex-proto/src/generated/vortex.expr.rs b/vortex-proto/src/generated/vortex.expr.rs
index a44328623e3..605f30c07ad 100644
--- a/vortex-proto/src/generated/vortex.expr.rs
+++ b/vortex-proto/src/generated/vortex.expr.rs
@@ -207,3 +207,15 @@ pub struct CaseWhenOpts {
     #[prost(uint32, tag = "1")]
     pub num_children: u32,
 }
+/// Options for `vortex.var`, a reference to a name bound in an enclosing scope.
+#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
+pub struct VariableOpts {
+    #[prost(string, tag = "1")]
+    pub name: ::prost::alloc::string::String,
+}
+/// Options for `vortex.lambda`. The body is the expression's single child.
+#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
+pub struct LambdaOpts {
+    #[prost(string, repeated, tag = "1")]
+    pub params: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
+}