@@ -116,14 +116,22 @@ one of them, and the failure is a bare `TypeError` from a `call1`. So:
   `python/datafusion/user_defined.py`, where the `Protocol` type hints for
   these methods live.
 
-## Rule 6 — the session a codec captures is not always the running session
+## Rule 6 — a fork must rebind the codecs it carries
 
 Installing a foreign query planner **forks** the session
-(`PySessionContext::ctx_with_rebound_planner`). A codec installed beforehand
-keeps pointing at the pre-fork session, so registrations made after the fork
-are invisible to it. Install codecs before the planner, which is what the
-contributor guide already advises. `PySessionContext::ancestors` keeps forked
-parents alive so the captured session cannot be dropped out from under a codec.
+(`PySessionContext::derived_parts`), because installing one writes to
+`SessionState` and the receiver must not be modified. A foreign codec holds an
+`FFI_TaskContextProvider` pointing at the session it was installed on, so the
+fork rebinds each one onto itself via
+`PySessionContext::rebound_{logical,physical}_codec`. Skip that and decode
+callbacks answer from the pre-fork registry.
+
+Rebinding relies on `FFI_{Logical,Physical}ExtensionCodec::new` adopting the
+provider on the already-foreign path, which needs DataFusion 55.1.0 or newer
+(apache/datafusion#24722). It clones the handle before overwriting, so the
+receiver keeps its own binding — assert that, not just that the fork works.
+A codec this library owns round-trips unchanged, so the rebind is safe to apply
+unconditionally.
 
 ## Where the truth is
 
 
@@ -77,6 +77,11 @@ codegen-units = 2
 
 # We cannot publish to crates.io with any patches in the below section. Developers
 # must remove any entries in this section before creating a release candidate.
+#
+# When these are removed, raise the DataFusion requirement above to 55.1.0. The
+# FFI codec rebinding in `PySessionContext::derived_parts` is a silent no-op
+# before that release (apache/datafusion#24722), so a 55.0.0 build would compile
+# and then resolve decode callbacks against the pre-fork session.
 [patch.crates-io]
 datafusion = { git = "https://github.com/timsaucer/datafusion", branch = "fix/ffi-constructor-argument-drop-55" }
 datafusion-substrait = { git = "https://github.com/timsaucer/datafusion", branch = "fix/ffi-constructor-argument-drop-55" }
 
@@ -373,16 +373,6 @@ pub struct PySessionContext {
     pub ctx: Arc<SessionContext>,
     logical_codec: Arc<PythonLogicalCodec>,
     physical_codec: Arc<PythonPhysicalCodec>,
-    /// Sessions this one was derived from, held only to keep them alive.
-    ///
-    /// A foreign codec installed here is built against the session current at
-    /// the time of the call, and `FFI_TaskContextProvider` holds that session
-    /// weakly. Installing a foreign query planner afterwards forks, and
-    /// rebinding the Python name would otherwise drop the session the codec
-    /// still points at. Retaining ancestors here rather than on the codec
-    /// avoids a cycle: nothing reachable from a `SessionContext` reaches back
-    /// to a `PySessionContext`.
-    ancestors: Vec<Arc<SessionContext>>,
 }
 
 #[pymethods]
@@ -415,7 +405,6 @@ impl PySessionContext {
             ctx,
             logical_codec: Arc::new(PythonLogicalCodec::default()),
             physical_codec: Arc::new(PythonPhysicalCodec::default()),
-            ancestors: Vec::new(),
         })
     }
 
@@ -424,7 +413,6 @@ impl PySessionContext {
             ctx: Arc::new(self.ctx.as_ref().clone().enable_url_table()),
             logical_codec: Arc::clone(&self.logical_codec),
             physical_codec: Arc::clone(&self.physical_codec),
-            ancestors: self.ancestors_including_self(),
         })
     }
 
@@ -436,7 +424,6 @@ impl PySessionContext {
             ctx,
             logical_codec: Arc::new(PythonLogicalCodec::default()),
             physical_codec: Arc::new(PythonPhysicalCodec::default()),
-            ancestors: Vec::new(),
         })
     }
 
@@ -1231,14 +1218,16 @@ impl PySessionContext {
     ) -> PyDataFusionResult<Self> {
         let planner = ffi_query_planner_from_pycapsule(&planner, Some(slf.as_any()))?;
         let this = slf.borrow();
-        let ctx =
-            this.ctx_with_rebound_planner(&this.logical_codec, &this.physical_codec, Some(planner));
+        let (ctx, logical_codec, physical_codec) = this.derived_parts(
+            Arc::clone(&this.logical_codec),
+            Arc::clone(&this.physical_codec),
+            Some(planner),
+        );
 
         Ok(Self {
-            ancestors: this.ancestors_for(&ctx),
             ctx,
-            logical_codec: Arc::clone(&this.logical_codec),
-            physical_codec: Arc::clone(&this.physical_codec),
+            logical_codec,
+            physical_codec,
         })
     }
 
@@ -1452,10 +1441,9 @@ impl PySessionContext {
         let logical_codec = Arc::new(PythonLogicalCodec::new(inner));
 
         let this = slf.borrow();
-        let physical_codec = Arc::clone(&this.physical_codec);
-        let ctx = this.ctx_with_rebound_planner(&logical_codec, &physical_codec, None);
+        let (ctx, logical_codec, physical_codec) =
+            this.derived_parts(logical_codec, Arc::clone(&this.physical_codec), None);
         Ok(Self {
-            ancestors: this.ancestors_for(&ctx),
             ctx,
             logical_codec,
             physical_codec,
@@ -1482,10 +1470,9 @@ impl PySessionContext {
         let physical_codec = Arc::new(PythonPhysicalCodec::new(inner));
 
         let this = slf.borrow();
-        let logical_codec = Arc::clone(&this.logical_codec);
-        let ctx = this.ctx_with_rebound_planner(&logical_codec, &physical_codec, None);
+        let (ctx, logical_codec, physical_codec) =
+            this.derived_parts(Arc::clone(&this.logical_codec), physical_codec, None);
         Ok(Self {
-            ancestors: this.ancestors_for(&ctx),
             ctx,
             logical_codec,
             physical_codec,
@@ -1501,9 +1488,9 @@ impl PySessionContext {
             PythonPhysicalCodec::new(Arc::clone(self.physical_codec.inner()))
                 .with_python_udf_inlining(enabled),
         );
-        let ctx = self.ctx_with_rebound_planner(&logical_codec, &physical_codec, None);
+        let (ctx, logical_codec, physical_codec) =
+            self.derived_parts(logical_codec, physical_codec, None);
         Self {
-            ancestors: self.ancestors_for(&ctx),
             ctx,
             logical_codec,
             physical_codec,
@@ -1512,50 +1499,35 @@ impl PySessionContext {
 }
 
 impl PySessionContext {
-    /// Keep-alive list for a context derived from this one.
-    ///
-    /// Sharing the same `SessionContext` carries the list through unchanged.
-    /// A fork adds this session, because a foreign codec installed here holds
-    /// it weakly and would otherwise dangle once the Python name is rebound.
-    fn ancestors_for(&self, derived: &Arc<SessionContext>) -> Vec<Arc<SessionContext>> {
-        if Arc::ptr_eq(derived, &self.ctx) {
-            self.ancestors.clone()
-        } else {
-            self.ancestors_including_self()
-        }
-    }
-
-    fn ancestors_including_self(&self) -> Vec<Arc<SessionContext>> {
-        let mut ancestors = self.ancestors.clone();
-        ancestors.push(Arc::clone(&self.ctx));
-        ancestors
-    }
-
-    /// Return the [`SessionContext`] a derived `PySessionContext` should use,
-    /// binding a foreign query planner to `logical_codec` and `physical_codec`.
+    /// Return the pieces a derived `PySessionContext` should hold, binding any
+    /// foreign query planner and foreign codecs to the session that will run
+    /// the query.
     ///
     /// Pass `Some(planner)` to install one, or `None` to rebind whichever
     /// planner the session already holds.
     ///
     /// With no foreign planner in play there is nothing to rebind, so the
-    /// existing context is shared and swapping codecs alone does not change
-    /// what a derived context observes. A foreign planner does have to be
-    /// rebound, and the FFI codecs capture the context they are built against,
-    /// so that case forks the session: the codecs are built from the fork and
-    /// then the fork's state is overwritten in place, because rebuilding the
-    /// context afterwards would leave the codecs pointing at a session that is
-    /// no longer used for planning.
+    /// existing context and codecs are shared unchanged. A foreign planner does
+    /// have to be rebound, and that forks the session, because installing it
+    /// writes to `SessionState` and the receiver must not be modified. The
+    /// codecs are built from the fork and the fork's state is then overwritten
+    /// in place, since rebuilding the context afterwards would leave them
+    /// pointing at a session that is no longer used for planning.
     ///
     /// A fork is not a deep copy. `SessionState` keeps its catalog list behind
     /// an `Arc`, so catalogs and tables stay shared with the original session,
     /// while registered functions and the configuration are snapshotted at the
     /// time of the call. The session id is deliberately carried over.
-    fn ctx_with_rebound_planner(
+    fn derived_parts(
         &self,
-        logical_codec: &Arc<PythonLogicalCodec>,
-        physical_codec: &Arc<PythonPhysicalCodec>,
+        logical_codec: Arc<PythonLogicalCodec>,
+        physical_codec: Arc<PythonPhysicalCodec>,
         planner: Option<FFI_QueryPlanner>,
-    ) -> Arc<SessionContext> {
+    ) -> (
+        Arc<SessionContext>,
+        Arc<PythonLogicalCodec>,
+        Arc<PythonPhysicalCodec>,
+    ) {
         let state = self.ctx.state();
 
         // When the caller is only replacing codecs, recover the handle behind
@@ -1570,23 +1542,66 @@ impl PySessionContext {
         });
 
         let Some(planner) = planner else {
-            return Arc::clone(&self.ctx);
+            return (Arc::clone(&self.ctx), logical_codec, physical_codec);
         };
 
         let ctx = Arc::new(SessionContext::new_with_state(state));
+        let logical_codec = Arc::new(Self::rebound_logical_codec(&ctx, &logical_codec));
+        let physical_codec = Arc::new(Self::rebound_physical_codec(&ctx, &physical_codec));
+
         let inner: Arc<dyn QueryPlanner + Send + Sync> = (&planner).into();
         let planner: Arc<dyn QueryPlanner + Send + Sync> = (&FFI_QueryPlanner::new_with_ffi_codecs(
             inner,
-            Self::ffi_logical_codec_for(&ctx, logical_codec),
-            Self::ffi_physical_codec_for(&ctx, physical_codec),
+            Self::ffi_logical_codec_for(&ctx, &logical_codec),
+            Self::ffi_physical_codec_for(&ctx, &physical_codec),
         ))
             .into();
         let state = SessionStateBuilder::new_from_existing(ctx.state())
             .with_query_planner(planner)
             .build();
         *ctx.state_ref().write() = state;
 
-        ctx
+        (ctx, logical_codec, physical_codec)
+    }
+
+    /// Rebind a foreign logical codec to `ctx`.
+    ///
+    /// A codec imported from another library holds an `FFI_TaskContextProvider`
+    /// pointing at whichever session it was installed on. Its decode callbacks
+    /// resolve names against that session, so a fork has to move them onto the
+    /// fork or they keep answering from the pre-fork registry.
+    ///
+    /// `FFI_LogicalExtensionCodec::new` adopts the provider supplied here when
+    /// the codec is already foreign, returning a *clone* of the handle, so the
+    /// context this codec was derived from keeps its own binding. A codec this
+    /// library owns has no stored provider, and round-trips back to the same
+    /// `Arc` unchanged, so this is safe to apply unconditionally.
+    fn rebound_logical_codec(
+        ctx: &Arc<SessionContext>,
+        codec: &Arc<PythonLogicalCodec>,
+    ) -> PythonLogicalCodec {
+        let ctx_provider = Arc::clone(ctx) as Arc<dyn TaskContextProvider>;
+        let runtime = get_tokio_runtime().handle().clone();
+        let rebound =
+            FFI_LogicalExtensionCodec::new(Arc::clone(codec.inner()), Some(runtime), &ctx_provider);
+        PythonLogicalCodec::new((&rebound).into())
+            .with_python_udf_inlining(codec.python_udf_inlining())
+    }
+
+    /// Physical counterpart of [`Self::rebound_logical_codec`].
+    fn rebound_physical_codec(
+        ctx: &Arc<SessionContext>,
+        codec: &Arc<PythonPhysicalCodec>,
+    ) -> PythonPhysicalCodec {
+        let ctx_provider = Arc::clone(ctx) as Arc<dyn TaskContextProvider>;
+        let runtime = get_tokio_runtime().handle().clone();
+        let rebound = FFI_PhysicalExtensionCodec::new(
+            Arc::clone(codec.inner()),
+            Some(runtime),
+            &ctx_provider,
+        );
+        PythonPhysicalCodec::new((&rebound).into())
+            .with_python_udf_inlining(codec.python_udf_inlining())
     }
 
     async fn _table(&self, name: &str) -> datafusion::common::Result<DataFrame> {
@@ -1816,7 +1831,6 @@ impl From<SessionContext> for PySessionContext {
             ctx: Arc::new(ctx),
             logical_codec: Arc::new(PythonLogicalCodec::default()),
             physical_codec: Arc::new(PythonPhysicalCodec::default()),
-            ancestors: Vec::new(),
         }
     }
 }
@@ -294,19 +294,27 @@ satisfies the same protocol an extension library implements. When you export the
 planner to wrap it, `ctx.__datafusion_query_planner__()` and
 `ctx.__datafusion_query_planner__(ctx)` are both fine.
 
-### A codec decodes against the session it was installed on
+### A codec decodes against the session that is running the query
 
 Because the provider comes from the host, a decode callback running inside an extension
-library resolves names against the session that is running the query. A function
-registered with `ctx.register_udf(...)` is visible to a foreign codec decoding a node
-that references it by name, and the handle is live rather than a snapshot, so a
-registration made after the codec is installed is visible too.
-
-The one boundary is the fork. Installing a foreign query planner forks the session, and
-a codec installed beforehand keeps pointing at the session it was built against, so a
-function registered after that point is not visible to it. This is the same rule as the
-caveat below, seen from the codec's side: register before deriving. Both halves are
-covered in
+library resolves names against the session running the query. A function registered with
+`ctx.register_udf(...)` is visible to a foreign codec decoding a node that references it
+by name, and the handle is live rather than a snapshot, so a registration made after the
+codec is installed is visible too.
+
+This survives a fork. Installing a foreign query planner forks the session, and the fork
+rebinds every foreign codec it carries onto the new session, so a function registered
+after the fork is still visible to them. `FFI_LogicalExtensionCodec::new` adopts the
+provider supplied to it when the codec is already foreign, returning a clone of the
+handle, so the context the fork was derived from keeps its own binding and continues to
+resolve against its own session.
+
+That behaviour requires DataFusion 55.1.0 or newer. Before it, those constructors
+silently discarded the provider, a foreign codec could not be rebound, and a fork left
+it resolving against the pre-fork session
+([apache/datafusion#24722](https://github.com/apache/datafusion/issues/24722)).
+
+All three properties are covered in
 `examples/datafusion-ffi-query-planner-example/python/tests/_test_three_library_query_planner.py`,
 where the example codecs take a `require_udf_on_decode` name and resolve it out of the
 task context they are handed.