diff --git a/Cargo.lock b/Cargo.lock
index a4e6268c..7487360e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3581,7 +3581,6 @@ dependencies = [
  "tempfile",
  "thiserror 2.0.12",
  "tokio",
- "ureq",
  "uuid",
 ]
 
diff --git a/Makefile b/Makefile
index 07dc0075..98e0b2e6 100644
--- a/Makefile
+++ b/Makefile
@@ -395,7 +395,7 @@ docs-clean:
 
 clean:
 	rm -rf dist docs/site probing/server/web-assets web/dist web/target
-	rm -rf python/probing/libs python/probing/shim/hccl
+	rm -rf python/probing/bundled_web python/probing/libs python/probing/shim/hccl
 	rm -rf .pytest_cache .coverage coverage.xml coverage.lcov
 	cargo clean
 	rm -f coverage.lcov coverage.json
diff --git a/docs/src/design/federation.md b/docs/src/design/federation.md
index 6ed1580a..c28988ce 100644
--- a/docs/src/design/federation.md
+++ b/docs/src/design/federation.md
@@ -233,17 +233,20 @@ flowchart LR
     RW --> EX[Execute shards]
     EX --> TG[Inject federation tags]
     TG --> MG[Merge / re-aggregate]
-    MG --> OUT[DataFrame + FanoutMeta]
+    MG --> OUT[QueryOutcome DataFrame + QueryQuality]
 ```
 
 **Conventions**
 
 | Item | Semantics |
 |------|-----------|
-| Response | `dataframe` + `meta.nodes_queried` + `meta.nodes_failed` |
+| Core result | `QueryOutcome<T>` always carries `data` and typed `QueryQuality`; partialness is not a task-local side channel |
+| HTTP response | `dataframe` + `meta.nodes_queried` + `meta.nodes_failed` |
 | Peer set | Snapshot of `cluster.nodes`, **excluding** coordinator listen addrs |
 | Peer execution | Always `probe.*`; peers must not fan-out again |
-| Concurrency | Parallel peer requests; latency ≈ slowest peer + coordinator merge |
+| Execution | SQL, extension capture, node discovery, and heartbeat HTTP share one async `FanoutService` |
+| Isolation | Peer network I/O runs on a dedicated Tokio runtime (`PROBING_FANOUT_WORKER_THREADS`), separate from Axum/DataFusion caller workers |
+| Concurrency | Shared bounded peer requests; latency ≈ slowest peer + coordinator merge |
 | Timeout | Failed peer → `nodes_failed`; default **30s** (`PROBING_REMOTE_QUERY_TIMEOUT_SECS`) |
 | Strict fan-out | `PROBING_FANOUT_STRICT=1` fails query on any `nodes_failed` or `peer_batches_dropped` (no partial merge) |
 | Partial HTTP | Cluster/fan-out APIs return **503** with partial `dataframe` when `meta.partial=true` (non-strict only) |
diff --git a/docs/src/design/federation.zh.md b/docs/src/design/federation.zh.md
index 4bdcc92e..3148c1de 100644
--- a/docs/src/design/federation.zh.md
+++ b/docs/src/design/federation.zh.md
@@ -240,17 +240,20 @@ flowchart LR
     RW --> EX[各分片执行]
     EX --> TG[注入联邦标签]
     TG --> MG[合并 / 二次聚合]
-    MG --> OUT[DataFrame + FanoutMeta]
+    MG --> OUT[QueryOutcome DataFrame + QueryQuality]
 ```
 
 **统一约定**
 
 | 项 | 语义 |
 |----|------|
-| 响应体 | `dataframe` + `meta.nodes_queried` + `meta.nodes_failed` |
+| Core 返回值 | `QueryOutcome<T>` 始终同时携带 `data` 与类型化 `QueryQuality`；partial 不再是 task-local 旁路状态 |
+| HTTP 响应体 | `dataframe` + `meta.nodes_queried` + `meta.nodes_failed` |
 | Peer 集合 | `cluster.nodes` 快照，**排除** coordinator 自身 listen addr |
 | Peer 执行 | 永远 `probe.*`；禁止 peer 再 fan-out（防递归） |
-| 并发 | 各 peer 并行请求；总延迟 ≈ 最慢 peer + coordinator 合并 |
+| 统一执行 | SQL、Extension 采集、节点发现和心跳 HTTP 共用一个异步 `FanoutService` |
+| 资源隔离 | Peer 网络 I/O 使用独立 Tokio runtime（`PROBING_FANOUT_WORKER_THREADS`），不占用 Axum/DataFusion 调用线程 |
+| 并发 | 共用有界并发；总延迟 ≈ 最慢 peer + coordinator 合并 |
 | 超时 | 失败 peer → `nodes_failed`；默认 **30s**（`PROBING_REMOTE_QUERY_TIMEOUT_SECS`） |
 | 严格 fan-out | `PROBING_FANOUT_STRICT=1`：任一 `nodes_failed` 或 `peer_batches_dropped` 则整查失败（无 partial merge） |
 | Partial HTTP | 集群/fan-out API 在 `meta.partial=true` 时返回 **503** 及 partial `dataframe`（非 strict 模式） |
diff --git a/docs/src/design/modularity.md b/docs/src/design/modularity.md
index a2c0ab82..742dd420 100644
--- a/docs/src/design/modularity.md
+++ b/docs/src/design/modularity.md
@@ -156,20 +156,22 @@ New work should extend **one** of these contracts instead of adding cross-module
   `global.<schema>.<table>`.
 - Do **not** query other collectors from inside `scan()`; join at SQL layer.
 
-### 3.2 `ProbeExtension` — config + imperative HTTP
+### 3.2 `ProbeExtension` — typed config + HTTP contracts
 
 **Where:** `probing/core/src/core/probe_extension.rs`
 **Derive:** `#[derive(ProbeExtension)]` in `probing-macros`
 
 | Capability | Mechanism |
 |------------|-----------|
-| Config keys | `probing.<namespace>.<option>` via `set` / `get` / `options` |
+| Identity | `ProbeExtension::name` supplies the registration namespace |
+| Config keys | `ProbeExtensionConfig` publishes typed key/alias specs and implements `set` / `get` / `options` |
 | Side effects | Background sampler start/stop in `set_*` handlers |
-| HTTP | `ProbeExtensionCall::call` → `/apis/<name>/...` fallback |
+| HTTP | `ProbeExtensionCall::routes` registers method/content-type/CORS/readiness contracts; `call` executes them |
 
 **Rules:**
 
 - Extension name = URL segment (`pythonext`, `rdmaextension`, …).
+- Registration validates names, duplicate routes, and config key/alias collisions before engine publication.
 - Prefer **tables for data**, extension for **control** (start/stop, eval, flamegraph render).
 - Never `todo!()` in default trait methods — return `EngineError`.
 
diff --git a/docs/src/design/modularity.zh.md b/docs/src/design/modularity.zh.md
index 71b29192..b6cc2ed6 100644
--- a/docs/src/design/modularity.zh.md
+++ b/docs/src/design/modularity.zh.md
@@ -145,17 +145,18 @@ HTTP 契约：`probing/server/API.md` + `tests/regression/spec/api_spec.json`。
 
 **规则：** schema/scan 在采集 crate 内；跨信号用 SQL JOIN，不在 `scan()` 里调别的采集器。
 
-### 3.2 `ProbeExtension` — 配置 + 命令式 HTTP
+### 3.2 `ProbeExtension` — 类型化配置与 HTTP 契约
 
 **定义：** `probing/core/src/core/probe_extension.rs`
 
 | 能力 | 机制 |
 |------|------|
-| 配置 | `probing.<ns>.<option>` |
+| 身份 | `ProbeExtension::name` 定义注册命名空间 |
+| 配置 | `ProbeExtensionConfig` 声明 key/alias 并实现 `set` / `get` / `options` |
 | 副作用 | `set_*` 里启停采样线程 |
-| HTTP | `/apis/<name>/...` |
+| HTTP | `ProbeExtensionCall::routes` 声明 method/content-type/CORS/readiness，`call` 负责执行 |
 
-**规则：** 数据走表，控制走 Extension；trait 默认实现禁止 `todo!()`。
+**规则：** 注册阶段校验扩展名、重复 route、配置 key/alias 冲突；数据走表，控制走 Extension；trait 默认实现禁止 `todo!()`。
 
 ### 3.3 Python `@table` — 应用数据插件
 
diff --git a/docs/src/reference/env-vars.md b/docs/src/reference/env-vars.md
index 86ce6957..cc5d898a 100644
--- a/docs/src/reference/env-vars.md
+++ b/docs/src/reference/env-vars.md
@@ -215,8 +215,8 @@ Hierarchical side-channel registration when `WORLD_SIZE > 1`. See [torchrun clus
 | `PROBING_CLUSTER_FANOUT_HIERARCHICAL` | `1` | Hierarchical cluster query fan-out (coordinator → local0 → leaves). `0` = flat fan-out to every peer. See [Hierarchical fan-out](../design/hierarchical-fanout.md). |
 | `PROBING_REMOTE_QUERY_TIMEOUT_SECS` | `30` | Per-peer timeout for remote federated / cluster queries (seconds). |
 | `PROBING_FANOUT_CONCURRENCY` | `128` | Max concurrent in-flight remote fan-out HTTP requests per query. |
+| `PROBING_FANOUT_WORKER_THREADS` | `4` | Worker threads in the isolated async fan-out runtime shared by distributed SQL, extension capture, discovery, and heartbeat requests. |
 | `PROBING_FANOUT_STRICT` | unset | When `1` or `true`, any federated peer failure or dropped batch fails the whole query instead of returning partial results. |
-| `PROBING_STACK_FANOUT_CONCURRENCY` | `32` | Max concurrent peer captures for Distributed stacks. |
 | `PROBING_STACK_FANOUT_DEADLINE_SEC` | `15` | Overall Distributed stacks fan-out deadline. Completed peers are returned as a partial flamegraph when the deadline expires. |
 | `PROBING_NCCL_CHUNK_BYTES` | `65536` | NCCL profiler mmap ring chunk size (bytes). |
 | `PROBING_NCCL_NUM_CHUNKS` | `64` | NCCL profiler mmap ring chunk count (~4 MiB total per table at defaults). |
diff --git a/docs/src/reference/env-vars.zh.md b/docs/src/reference/env-vars.zh.md
index 7a9e4662..c327d62d 100644
--- a/docs/src/reference/env-vars.zh.md
+++ b/docs/src/reference/env-vars.zh.md
@@ -27,7 +27,7 @@ Probing 读取的全部 `PROBING_*` 环境变量参考（按子系统分组）
 | `PROBING_CLUSTER_FANOUT_HIERARCHICAL` | `1` | 分层集群查询 fan-out；`0` = 扁平 fan-out 到所有 peer。 |
 | `PROBING_REMOTE_QUERY_TIMEOUT_SECS` | `30` | 远程联邦 / 集群查询的单 peer 超时（秒）。 |
 | `PROBING_FANOUT_CONCURRENCY` | `128` | 单次 cluster fan-out 的最大并发远程 HTTP 请求数。 |
-| `PROBING_STACK_FANOUT_CONCURRENCY` | `32` | Distributed stacks 同时采集的最大 peer 数。 |
+| `PROBING_FANOUT_WORKER_THREADS` | `4` | 分布式 SQL、Extension 采集、节点发现和心跳共用的独立异步 fan-out runtime 线程数。 |
 | `PROBING_STACK_FANOUT_DEADLINE_SEC` | `15` | Distributed stacks 的整体 fan-out 截止时间；超时后返回已完成 peer 的部分火焰图并列出失败 peer。 |
 | `PROBING_ADVERTISE_ADDR` | `MASTER_ADDR`，否则 hostname | wildcard bind 时向 peer 发布的地址；支持 `host`、`host:port`、IPv6 或 `{port}` 占位符。多网卡环境或 `MASTER_ADDR` 不是当前节点的 peer 可达地址时必须显式设置。 |
 | `PROBING_NODE_HOST` | 操作系统 hostname | cluster heartbeat 中上报的显式 host 标签。用于容器身份和本地逻辑节点 fixture；不会改变向 peer 发布的网络地址。 |
diff --git a/probing/cli/src/cli/ctrl.rs b/probing/cli/src/cli/ctrl.rs
index ee533fd3..a23d5fe6 100644
--- a/probing/cli/src/cli/ctrl.rs
+++ b/probing/cli/src/cli/ctrl.rs
@@ -152,19 +152,14 @@ impl ProbeEndpoint {
         let q_str = serde_json::to_string(&request)?;
         let reply_str = self.send_request("/query", &q_str).await?; // Renamed reply variable
         let msg = serde_json::from_str::<Message<QueryDataFormat>>(&reply_str)?;
-        if let Some(meta) = &msg.meta {
-            if meta
-                .get("fanout")
-                .and_then(|f| f.get("partial"))
-                .and_then(|v| v.as_bool())
-                .unwrap_or(false)
-            {
+        if let Some(quality) = msg.meta.as_ref().and_then(|meta| meta.fanout.as_ref()) {
+            if quality.is_partial() {
                 if fanout_strict_enabled() {
                     return Err(anyhow::anyhow!(
-                        "federated fan-out strict mode: query returned partial data: {meta}"
+                        "federated fan-out strict mode: query returned partial data: {quality:?}"
                     ));
                 }
-                eprintln!("warning: federated query returned partial data: {meta}");
+                eprintln!("warning: federated query returned partial data: {quality:?}");
             }
         }
         let reply = msg.payload;
diff --git a/probing/core/src/config.rs b/probing/core/src/config.rs
index a7c82a04..16aa9df2 100644
--- a/probing/core/src/config.rs
+++ b/probing/core/src/config.rs
@@ -124,7 +124,10 @@ pub async fn write(key: &str, value: &str) -> Result<(), EngineError> {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::core::{ProbeExtension, ProbeExtensionCall, ProbeExtensionOption};
+    use crate::core::{
+        ExtensionConfigSpec, ProbeExtension, ProbeExtensionCall, ProbeExtensionConfig,
+        ProbeExtensionOption,
+    };
     use crate::{create_engine, initialize_engine};
 
     async fn setup_test() -> tokio::sync::MutexGuard<'static, ()> {
@@ -156,6 +159,16 @@ mod tests {
         fn name(&self) -> String {
             "test".to_string()
         }
+    }
+
+    impl ProbeExtensionConfig for TestExtension {
+        fn config_specs(&self) -> &'static [ExtensionConfigSpec] {
+            &[ExtensionConfigSpec {
+                key: "option",
+                aliases: &[],
+                help: "Test option",
+            }]
+        }
 
         fn set(&mut self, key: &str, value: &str) -> Result<String, EngineError> {
             match key {
diff --git a/probing/core/src/core/engine.rs b/probing/core/src/core/engine.rs
index fbc36be1..71d6a881 100644
--- a/probing/core/src/core/engine.rs
+++ b/probing/core/src/core/engine.rs
@@ -10,6 +10,7 @@ use datafusion::error::DataFusionError;
 use datafusion::error::Result;
 use datafusion::execution::SessionState;
 use datafusion::prelude::{DataFrame, SessionConfig, SessionContext};
+use probing_proto::prelude::QueryOutcome;
 
 use super::arrow_convert::{arrow_array_to_seq, empty_seq_for_data_type};
 use super::probe_extension::ProbeExtension;
@@ -17,7 +18,7 @@ use super::probe_extension::ProbeExtensionManager;
 
 use super::data_source::{ProbeDataSource, ProbeDataSourceKind};
 use super::federation;
-use super::federation::PeerQueryTransport;
+use super::federation::FanoutService;
 use super::metadata_rewrite;
 use super::semantic_catalog;
 
@@ -54,7 +55,7 @@ pub struct Engine {
     pub context: SessionContext,
     /// Registry of enabled plugins, mapped by their fully qualified names
     data_sources: RwLock<HashMap<String, Arc<dyn ProbeDataSource + Sync + Send>>>,
-    peer_query_transport: Option<Arc<dyn PeerQueryTransport>>,
+    fanout_service: Option<Arc<dyn FanoutService>>,
 }
 
 impl Clone for Engine {
@@ -64,7 +65,7 @@ impl Clone for Engine {
         Self {
             context: self.context.clone(),
             data_sources: RwLock::new(plugins_clone),
-            peer_query_transport: self.peer_query_transport.clone(),
+            fanout_service: self.fanout_service.clone(),
         }
     }
 }
@@ -83,7 +84,7 @@ impl Default for Engine {
         Engine {
             context: SessionContext::new_with_config(config),
             data_sources: Default::default(),
-            peer_query_transport: None,
+            fanout_service: None,
         }
     }
 }
@@ -106,14 +107,49 @@ impl Engine {
         self.context.sql(query).await
     }
 
+    /// Execute SQL and return both data and distributed completeness.
+    ///
+    /// New callers should use this method so partial federated results cannot
+    /// be mistaken for complete data.
+    pub async fn query_outcome<T: Into<String>>(
+        &self,
+        query: T,
+    ) -> Result<QueryOutcome<Option<probing_proto::prelude::DataFrame>>> {
+        let query = query.into();
+        federation::with_fanout_scope_async(federation::current_fanout_scope(), async move {
+            federation::reset_fanout_stats();
+            let data = self.async_query_data(query).await?;
+            let quality = federation::take_fanout_stats();
+            federation::enforce_fanout_strict(&quality)?;
+            Ok(QueryOutcome::with_quality(data, quality))
+        })
+        .await
+    }
+
+    /// Compatibility data-only query API.
+    ///
+    /// Control-plane and diagnostic callers must prefer [`Self::query_outcome`].
     pub async fn async_query<T: Into<String>>(
         &self,
         query: T,
+    ) -> Result<Option<probing_proto::prelude::DataFrame>> {
+        let outcome = self.query_outcome(query).await?;
+        if outcome.quality.is_partial() {
+            return Err(DataFusionError::Execution(
+                "query returned partial data; use Engine::query_outcome to inspect completeness"
+                    .to_string(),
+            ));
+        }
+        Ok(outcome.data)
+    }
+
+    async fn async_query_data<T: Into<String>>(
+        &self,
+        query: T,
     ) -> Result<Option<probing_proto::prelude::DataFrame>> {
         let original: String = query.into();
         let capped = federation::ensure_global_scan_limit(&original);
         if let Some(df) = federation::try_execute_aggregate_pushdown(self, &capped).await? {
-            federation::check_fanout_strict()?;
             return Ok(Some(df));
         }
         let default_schema = self.default_namespace();
@@ -123,7 +159,6 @@ impl Engine {
         let df = self.sql(query.as_str()).await?;
         let schema = df.schema().clone();
         let batches = df.collect().await?;
-        federation::check_fanout_strict()?;
         if batches.is_empty() {
             let names = schema
                 .fields()
@@ -206,8 +241,8 @@ impl Engine {
         Ok(())
     }
 
-    pub fn peer_query_transport(&self) -> Option<Arc<dyn PeerQueryTransport>> {
-        self.peer_query_transport.clone()
+    pub fn fanout_service(&self) -> Option<Arc<dyn FanoutService>> {
+        self.fanout_service.clone()
     }
 }
 
@@ -216,8 +251,11 @@ pub struct EngineBuilder {
     config: SessionConfig,
     default_namespace: Option<String>,
     data_sources: Vec<Arc<dyn ProbeDataSource + Sync + Send>>,
-    probe_extensions: HashMap<String, Arc<tokio::sync::Mutex<dyn ProbeExtension + Send + Sync>>>,
-    peer_query_transport: Option<Arc<dyn PeerQueryTransport>>,
+    probe_extensions: Vec<(
+        String,
+        Arc<tokio::sync::Mutex<dyn ProbeExtension + Send + Sync>>,
+    )>,
+    fanout_service: Option<Arc<dyn FanoutService>>,
 }
 
 impl EngineBuilder {
@@ -228,7 +266,7 @@ impl EngineBuilder {
             default_namespace: None,
             data_sources: Vec::new(),
             probe_extensions: Default::default(),
-            peer_query_transport: None,
+            fanout_service: None,
         }
     }
 
@@ -251,20 +289,20 @@ impl EngineBuilder {
         let name = ext.name();
         let ext = Arc::new(tokio::sync::Mutex::new(ext));
 
-        self.probe_extensions.insert(name, ext);
+        self.probe_extensions.push((name, ext));
         self
     }
 
-    pub fn with_peer_query_transport(mut self, transport: Arc<dyn PeerQueryTransport>) -> Self {
-        self.peer_query_transport = Some(transport);
+    pub fn with_fanout_service(mut self, service: Arc<dyn FanoutService>) -> Self {
+        self.fanout_service = Some(service);
         self
     }
 
     // Build the Engine with the specified configurations
     pub async fn build(mut self) -> Result<Engine> {
         let mut eem = ProbeExtensionManager::default();
-        for (name, extension) in self.probe_extensions.iter() {
-            eem.register(name.clone(), extension.clone()).await;
+        for (name, extension) in &self.probe_extensions {
+            eem.register(name.clone(), extension.clone()).await?;
         }
         self.config.options_mut().extensions.insert(eem);
         if let Some(namespace) = self.default_namespace {
@@ -282,13 +320,13 @@ impl EngineBuilder {
         let engine = Engine {
             context,
             data_sources: Default::default(),
-            peer_query_transport: self.peer_query_transport,
+            fanout_service: self.fanout_service,
         };
         for data_source in self.data_sources {
             engine.enable(data_source).await?;
         }
         semantic_catalog::install_semantic_catalog(&engine.context)?;
-        federation::install_global_catalog(&engine.context, engine.peer_query_transport())?;
+        federation::install_global_catalog(&engine.context, engine.fanout_service())?;
 
         Ok(engine)
     }
@@ -302,7 +340,7 @@ impl Default for EngineBuilder {
 
 #[cfg(test)]
 mod tests {
-    use crate::core::{ProbeExtension, ProbeExtensionCall};
+    use crate::core::{ProbeExtension, ProbeExtensionCall, ProbeExtensionConfig};
 
     use super::*;
     use arrow::array::{Int32Array, StringArray};
@@ -319,30 +357,39 @@ mod tests {
     use std::sync::Arc;
 
     #[derive(Debug)]
-    struct TestPeerTransport;
+    struct TestFanoutService;
 
-    impl PeerQueryTransport for TestPeerTransport {
-        fn query(
+    #[async_trait::async_trait]
+    impl federation::FanoutService for TestFanoutService {
+        async fn query_peer(
             &self,
             _addr: &str,
             _sql: &str,
             _scope: federation::FanoutScope,
         ) -> Result<federation::PeerQueryOutcome> {
-            unreachable!("transport isolation test does not execute queries")
+            unreachable!("fan-out service isolation test does not execute queries")
+        }
+
+        async fn request_peer(
+            &self,
+            _addr: &str,
+            _request: federation::FanoutHttpRequest,
+        ) -> Result<federation::FanoutHttpResponse> {
+            unreachable!("fan-out service isolation test does not execute requests")
         }
     }
 
     #[tokio::test]
-    async fn peer_transport_is_scoped_to_the_built_engine() {
+    async fn fanout_service_is_scoped_to_the_built_engine() {
         let configured = Engine::builder()
-            .with_peer_query_transport(Arc::new(TestPeerTransport))
+            .with_fanout_service(Arc::new(TestFanoutService))
             .build()
             .await
             .unwrap();
         let plain = Engine::builder().build().await.unwrap();
 
-        assert!(configured.peer_query_transport().is_some());
-        assert!(plain.peer_query_transport().is_none());
+        assert!(configured.fanout_service().is_some());
+        assert!(plain.fanout_service().is_none());
     }
 
     #[derive(Debug, Clone)]
@@ -493,6 +540,8 @@ mod tests {
             }
         }
 
+        impl ProbeExtensionConfig for TestExtension {}
+
         impl ProbeExtensionCall for TestExtension {}
 
         let engine = Engine::builder()
@@ -511,6 +560,30 @@ mod tests {
         assert!(result.unwrap().is_some());
     }
 
+    #[tokio::test]
+    async fn duplicate_extension_registration_is_rejected() {
+        #[derive(Debug)]
+        struct DuplicateExtension;
+
+        impl ProbeExtension for DuplicateExtension {
+            fn name(&self) -> String {
+                "duplicate".into()
+            }
+        }
+
+        impl ProbeExtensionConfig for DuplicateExtension {}
+        impl ProbeExtensionCall for DuplicateExtension {}
+
+        let error = Engine::builder()
+            .with_extension(DuplicateExtension)
+            .with_extension(DuplicateExtension)
+            .build()
+            .await
+            .err()
+            .expect("duplicate extension must fail engine construction");
+        assert!(error.to_string().contains("duplicate extension name"));
+    }
+
     #[tokio::test]
     async fn test_plugin_registration() {
         let engine = Engine::builder().build().await.unwrap();
diff --git a/probing/core/src/core/federation/aggregate_pushdown.rs b/probing/core/src/core/federation/aggregate_pushdown.rs
index 2426cc86..47b7bec8 100644
--- a/probing/core/src/core/federation/aggregate_pushdown.rs
+++ b/probing/core/src/core/federation/aggregate_pushdown.rs
@@ -95,31 +95,26 @@ pub async fn try_execute_aggregate_pushdown(
     }
 
     let per_node_sql = plan.per_node_sql.clone();
-    let transport = engine.peer_query_transport();
+    let service = engine.fanout_service();
     let mut stats = FanoutStats::default();
 
     if scope == FanoutScope::Coordinator && is_local0_from_env() {
         let leaf_sql = per_node_sql.clone();
-        let leaf_transport = transport.clone();
-        let leaf_outcomes = tokio::task::spawn_blocking(move || {
-            ProbeClusterExecutor::fanout_query_to_peers_scoped(
-                &leaf_sql,
-                FanoutScope::Node,
-                leaf_transport,
-            )
-        })
-        .await
-        .map_err(|e| DataFusionError::Execution(format!("local leaf fan-out failed: {e}")))?;
+        let leaf_service = service.clone();
+        let leaf_outcomes = ProbeClusterExecutor::fanout_query_to_peers_scoped(
+            &leaf_sql,
+            FanoutScope::Node,
+            leaf_service,
+        )
+        .await;
         append_fanout_outcomes(&mut proto_parts, &mut stats, &plan, leaf_outcomes);
     }
 
     let remote_scope = scope;
     let remote_sql = per_node_sql.clone();
-    let outcomes = tokio::task::spawn_blocking(move || {
-        ProbeClusterExecutor::fanout_query_to_peers_scoped(&remote_sql, remote_scope, transport)
-    })
-    .await
-    .map_err(|e| DataFusionError::Execution(format!("aggregate fan-out join failed: {e}")))?;
+    let outcomes =
+        ProbeClusterExecutor::fanout_query_to_peers_scoped(&remote_sql, remote_scope, service)
+            .await;
     append_fanout_outcomes(&mut proto_parts, &mut stats, &plan, outcomes);
 
     if proto_parts.is_empty() {
diff --git a/probing/core/src/core/federation/cluster_executor.rs b/probing/core/src/core/federation/cluster_executor.rs
index a38705f9..9b31d11c 100644
--- a/probing/core/src/core/federation/cluster_executor.rs
+++ b/probing/core/src/core/federation/cluster_executor.rs
@@ -4,7 +4,9 @@ use std::sync::{Arc, LazyLock};
 use std::sync::{Mutex, MutexGuard};
 use std::time::Duration;
 
+use async_trait::async_trait;
 use datafusion::error::{DataFusionError, Result};
+use futures::stream::{self, StreamExt};
 use probing_proto::prelude::{DataFrame, Node};
 
 use crate::core::cluster::{
@@ -22,9 +24,101 @@ type RemoteQueryHook = Box<dyn Fn(&str, &str) -> Result<DataFrame> + Send + Sync
 static REMOTE_QUERY_HOOK: LazyLock<Mutex<Option<RemoteQueryHook>>> =
     LazyLock::new(|| Mutex::new(None));
 
-/// L3-provided transport for L1 federation execution.
-pub trait PeerQueryTransport: Debug + Send + Sync {
-    fn query(&self, addr: &str, sql: &str, scope: FanoutScope) -> Result<PeerQueryOutcome>;
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum FanoutHttpMethod {
+    Get,
+    Post,
+    Put,
+}
+
+#[derive(Debug, Clone)]
+pub struct FanoutHttpRequest {
+    pub method: FanoutHttpMethod,
+    pub path: String,
+    pub content_type: Option<String>,
+    pub body: Vec<u8>,
+    pub timeout: Duration,
+}
+
+#[derive(Debug, Clone)]
+pub struct FanoutHttpResponse {
+    pub status: u16,
+    pub body: Vec<u8>,
+}
+
+/// One peer plus the routing scope used for its request.
+#[derive(Debug, Clone)]
+pub struct FanoutTarget {
+    pub node: Node,
+    pub scope: FanoutScope,
+}
+
+/// L3-provided distributed execution service for SQL and extension requests.
+///
+/// Implementations own scheduling, authentication, deadlines, and execution
+/// resources. Core and collectors only describe peer work through this contract.
+#[async_trait]
+pub trait FanoutService: Debug + Send + Sync {
+    async fn query_peer(
+        &self,
+        addr: &str,
+        sql: &str,
+        scope: FanoutScope,
+    ) -> Result<PeerQueryOutcome>;
+
+    async fn request_peer(
+        &self,
+        addr: &str,
+        request: FanoutHttpRequest,
+    ) -> Result<FanoutHttpResponse>;
+
+    async fn query_many(&self, targets: Vec<FanoutTarget>, sql: &str) -> Vec<RemoteFanoutResult> {
+        let sql = sql.to_string();
+        let request_count = targets.len().max(1);
+        stream::iter(targets)
+            .map(|target| {
+                let sql = sql.clone();
+                async move {
+                    let node = target.node;
+                    let host = if node.host.is_empty() {
+                        node.addr.clone()
+                    } else {
+                        node.host.clone()
+                    };
+                    let result = self.query_peer(&node.addr, &sql, target.scope).await;
+                    RemoteFanoutResult {
+                        addr: node.addr,
+                        host,
+                        rank: node.rank,
+                        result,
+                    }
+                }
+            })
+            // The service owns the global limiter. Poll every request so its
+            // deadline includes time waiting for an execution permit.
+            .buffer_unordered(request_count)
+            .collect()
+            .await
+    }
+
+    async fn request_many(
+        &self,
+        nodes: Vec<Node>,
+        request: FanoutHttpRequest,
+    ) -> Vec<(Node, Result<FanoutHttpResponse>)> {
+        let request_count = nodes.len().max(1);
+        stream::iter(nodes)
+            .map(|node| {
+                let request = request.clone();
+                async move {
+                    let result = self.request_peer(&node.addr, request).await;
+                    (node, result)
+                }
+            })
+            .buffer_unordered(request_count)
+            .collect()
+            .await
+    }
 }
 
 /// Data and completeness metadata returned for one remote subtree.
@@ -235,69 +329,71 @@ impl ProbeClusterExecutor {
 
     /// Execute `sql` on every peer node concurrently, returning each node's result.
     ///
-    /// Requests run in parallel (one OS thread per peer via [`std::thread::scope`]),
-    /// so total latency is bounded by the slowest peer rather than the sum of all
-    /// peers. Node identity is preserved for row tagging and fan-out accounting.
-    pub fn fanout_query_to_peers(
+    /// Requests run through the L3-provided service. Its execution resources are
+    /// isolated from the caller runtime; node identity is preserved for tagging
+    /// and fan-out accounting.
+    pub async fn fanout_query_to_peers(
         sql: &str,
-        transport: Option<Arc<dyn PeerQueryTransport>>,
+        service: Option<Arc<dyn FanoutService>>,
     ) -> Vec<RemoteFanoutResult> {
-        Self::fanout_query_to_peers_scoped(sql, current_fanout_scope(), transport)
+        Self::fanout_query_to_peers_scoped(sql, current_fanout_scope(), service).await
     }
 
-    pub fn fanout_query_to_peers_scoped(
+    pub async fn fanout_query_to_peers_scoped(
         sql: &str,
         scope: FanoutScope,
-        transport: Option<Arc<dyn PeerQueryTransport>>,
+        service: Option<Arc<dyn FanoutService>>,
     ) -> Vec<RemoteFanoutResult> {
         let nodes = Self::remote_nodes_for_scope(scope);
         if nodes.is_empty() {
             return Vec::new();
         }
         let scope = resolve_fanout_scope(scope);
-        let concurrency = remote_fanout_concurrency();
-        let mut results = Vec::with_capacity(nodes.len());
-        for chunk in nodes.chunks(concurrency) {
-            std::thread::scope(|s| {
-                let handles: Vec<_> = chunk
-                    .iter()
-                    .map(|node| {
-                        let node = node.clone();
-                        let transport = transport.clone();
-                        s.spawn(move || {
-                            let host = if node.host.is_empty() {
-                                node.addr.clone()
-                            } else {
-                                node.host.clone()
-                            };
-                            let result = Self::execute_remote_scoped(
-                                transport.as_ref(),
-                                &node.addr,
-                                sql,
-                                scope,
-                            );
-                            RemoteFanoutResult {
-                                addr: node.addr,
-                                host,
-                                rank: node.rank,
-                                result,
-                            }
-                        })
-                    })
-                    .collect();
-                for handle in handles {
-                    results.push(handle.join().unwrap_or_else(|_| RemoteFanoutResult {
-                        addr: String::new(),
-                        host: String::new(),
-                        rank: None,
-                        result: Err(DataFusionError::Execution(
-                            "remote query thread panicked".into(),
-                        )),
-                    }));
-                }
-            });
+        #[cfg(any(test, feature = "test-utils"))]
+        if lock_remote_query_hook().is_some() {
+            return stream::iter(nodes)
+                .map(|node| {
+                    let service = service.clone();
+                    let sql = sql.to_string();
+                    async move {
+                        let host = if node.host.is_empty() {
+                            node.addr.clone()
+                        } else {
+                            node.host.clone()
+                        };
+                        let result =
+                            Self::execute_remote_scoped(service.as_ref(), &node.addr, &sql, scope)
+                                .await;
+                        RemoteFanoutResult {
+                            addr: node.addr,
+                            host,
+                            rank: node.rank,
+                            result,
+                        }
+                    }
+                })
+                .buffer_unordered(remote_fanout_concurrency())
+                .collect()
+                .await;
         }
-        results
+        let Some(service) = service else {
+            return nodes
+                .into_iter()
+                .map(|node| RemoteFanoutResult {
+                    addr: node.addr,
+                    host: node.host,
+                    rank: node.rank,
+                    result: Err(DataFusionError::Execution(
+                        "fan-out service is not configured".to_string(),
+                    )),
+                })
+                .collect();
+        };
+        let targets = nodes
+            .into_iter()
+            .map(|node| FanoutTarget { node, scope })
+            .collect();
+        service.query_many(targets, sql).await
     }
 
     /// Remote partitions for a federated table scan.
@@ -364,25 +460,25 @@ impl ProbeClusterExecutor {
             .collect()
     }
 
-    pub fn execute_remote_query(
-        transport: Option<&Arc<dyn PeerQueryTransport>>,
+    pub async fn execute_remote_query(
+        service: Option<&Arc<dyn FanoutService>>,
         addr: &str,
         sql: &str,
     ) -> Result<PeerQueryOutcome> {
-        Self::execute_remote_for_scope(transport, addr, sql, current_fanout_scope())
+        Self::execute_remote_for_scope(service, addr, sql, current_fanout_scope()).await
     }
 
-    pub fn execute_remote_for_scope(
-        transport: Option<&Arc<dyn PeerQueryTransport>>,
+    pub async fn execute_remote_for_scope(
+        service: Option<&Arc<dyn FanoutService>>,
         addr: &str,
         sql: &str,
         scope: FanoutScope,
     ) -> Result<PeerQueryOutcome> {
-        Self::execute_remote_scoped(transport, addr, sql, scope)
+        Self::execute_remote_scoped(service, addr, sql, scope).await
     }
 
-    fn execute_remote_scoped(
-        transport: Option<&Arc<dyn PeerQueryTransport>>,
+    async fn execute_remote_scoped(
+        service: Option<&Arc<dyn FanoutService>>,
         addr: &str,
         sql: &str,
         scope: FanoutScope,
@@ -392,10 +488,10 @@ impl ProbeClusterExecutor {
         if let Some(hook) = lock_remote_query_hook().as_ref() {
             return hook(addr, sql).map(PeerQueryOutcome::complete);
         }
-        let transport = transport.ok_or_else(|| {
-            DataFusionError::Execution("peer query transport is not configured".to_string())
+        let service = service.ok_or_else(|| {
+            DataFusionError::Execution("fan-out service is not configured".to_string())
         })?;
-        transport.query(addr, sql, scope)
+        service.query_peer(addr, sql, scope).await
     }
 }
 
diff --git a/probing/core/src/core/federation/fanout_scope.rs b/probing/core/src/core/federation/fanout_scope.rs
index f9ef42da..dbb44942 100644
--- a/probing/core/src/core/federation/fanout_scope.rs
+++ b/probing/core/src/core/federation/fanout_scope.rs
@@ -6,6 +6,8 @@ use std::cell::{Cell, RefCell};
 use std::future::Future;
 use std::sync::{Arc, Mutex, MutexGuard};
 
+pub type FanoutStats = probing_proto::prelude::QueryQuality;
+
 /// How remote peers are selected for federated / cluster fan-out.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
 pub enum FanoutScope {
@@ -33,36 +35,6 @@ impl FanoutScope {
     }
 }
 
-/// Outcome of a federated query's remote work.
-#[derive(Debug, Default, Clone, PartialEq, Eq)]
-pub struct FanoutStats {
-    pub nodes_succeeded: usize,
-    pub nodes_failed: Vec<String>,
-    /// Peer partial DataFrames dropped during coordinator merge (conversion failure).
-    pub peer_batches_dropped: usize,
-    /// True when any descendant reported incomplete data, even if it did not
-    /// provide a concrete failed-node or dropped-batch count.
-    pub partial: bool,
-}
-
-impl FanoutStats {
-    /// A successful transport response from one leaf endpoint.
-    pub fn complete_node() -> Self {
-        Self {
-            nodes_succeeded: 1,
-            ..Self::default()
-        }
-    }
-
-    /// Merge a complete child-subtree outcome into the current request.
-    pub fn absorb(&mut self, child: Self) {
-        self.nodes_succeeded += child.nodes_succeeded;
-        self.nodes_failed.extend(child.nodes_failed);
-        self.peer_batches_dropped += child.peer_batches_dropped;
-        self.partial |= child.partial;
-    }
-}
-
 /// Shareable stats sink captured by physical execution plans.
 #[derive(Debug, Clone, Default)]
 pub(crate) struct FanoutStatsHandle(Arc<Mutex<FanoutStats>>);
diff --git a/probing/core/src/core/federation/federated_scan_exec.rs b/probing/core/src/core/federation/federated_scan_exec.rs
index a2f25d9f..4ffb5aa9 100644
--- a/probing/core/src/core/federation/federated_scan_exec.rs
+++ b/probing/core/src/core/federation/federated_scan_exec.rs
@@ -28,7 +28,7 @@ use futures::StreamExt;
 use probing_proto::prelude::DataFrame;
 
 use super::cluster_executor::{
-    fanout_strict_enabled, FederatedScanTarget, PeerQueryTransport, ProbeClusterExecutor,
+    fanout_strict_enabled, FanoutService, FederatedScanTarget, ProbeClusterExecutor,
 };
 use super::convert::{align_batch_to_schema, dataframe_to_record_batch, tag_record_batch};
 use super::fanout_scope::FanoutStatsHandle;
@@ -61,7 +61,7 @@ pub struct FederatedScanExec {
     local_rank: Option<i32>,
     /// Request-owned sink; explicit because DataFusion may poll partitions in child tasks.
     fanout_stats: FanoutStatsHandle,
-    transport: Option<Arc<dyn PeerQueryTransport>>,
+    service: Option<Arc<dyn FanoutService>>,
     properties: Arc<PlanProperties>,
 }
 
@@ -77,7 +77,7 @@ impl FederatedScanExec {
         local_addr: String,
         local_rank: Option<i32>,
         fanout_stats: FanoutStatsHandle,
-        transport: Option<Arc<dyn PeerQueryTransport>>,
+        service: Option<Arc<dyn FanoutService>>,
     ) -> Result<Self> {
         let projected_schema = Arc::new(
             output_schema
@@ -102,7 +102,7 @@ impl FederatedScanExec {
             local_addr,
             local_rank,
             fanout_stats,
-            transport,
+            service,
             properties: Arc::new(properties),
         })
     }
@@ -146,23 +146,21 @@ impl FederatedScanExec {
         let projection = self.projection.clone();
         let projected_schema = self.projected_schema.clone();
         let fanout_stats = self.fanout_stats.clone();
-        let transport = self.transport.clone();
+        let service = self.service.clone();
 
         // Best-effort fetch: failures (network, conversion) drop the node from
         // the result set and are recorded in the fan-out stats rather than
         // failing the whole query, matching the legacy partial-result behavior.
         let fut = async move {
-            let joined = tokio::task::spawn_blocking(move || {
-                ProbeClusterExecutor::execute_remote_for_scope(
-                    transport.as_ref(),
-                    &addr_query,
-                    &sql,
-                    remote_scope,
-                )
-            })
+            let result = ProbeClusterExecutor::execute_remote_for_scope(
+                service.as_ref(),
+                &addr_query,
+                &sql,
+                remote_scope,
+            )
             .await;
-            match joined {
-                Ok(Ok(outcome)) => match finalize_remote_dataframe(
+            match result {
+                Ok(outcome) => match finalize_remote_dataframe(
                     &outcome.dataframe,
                     &host,
                     &addr_tag,
@@ -185,18 +183,9 @@ impl FederatedScanExec {
                         None
                     }
                 },
-                Ok(Err(err)) => {
-                    log_federated_peer_failure(
-                        "federated scan skipped",
-                        &addr_tag,
-                        &err.to_string(),
-                    );
-                    fanout_stats.record_failure(&addr_tag);
-                    None
-                }
                 Err(err) => {
                     log_federated_peer_failure(
-                        "federated scan join failed for",
+                        "federated scan skipped",
                         &addr_tag,
                         &err.to_string(),
                     );
@@ -291,7 +280,7 @@ impl ExecutionPlan for FederatedScanExec {
             local_addr: self.local_addr.clone(),
             local_rank: self.local_rank,
             fanout_stats: self.fanout_stats.clone(),
-            transport: self.transport.clone(),
+            service: self.service.clone(),
             properties: self.properties.clone(),
         }))
     }
diff --git a/probing/core/src/core/federation/global_catalog.rs b/probing/core/src/core/federation/global_catalog.rs
index 40a0b3df..e271d641 100644
--- a/probing/core/src/core/federation/global_catalog.rs
+++ b/probing/core/src/core/federation/global_catalog.rs
@@ -7,7 +7,7 @@ use datafusion::error::Result;
 use datafusion::execution::context::SessionContext;
 
 use super::global_table::GlobalFederatedTable;
-use super::PeerQueryTransport;
+use super::FanoutService;
 
 pub const GLOBAL_CATALOG: &str = "global";
 const SKIP_SCHEMAS: &[&str] = &["information_schema"];
@@ -19,12 +19,12 @@ const SKIP_SCHEMAS: &[&str] = &["information_schema"];
 /// under `global.*` without refreshing or rebuilding the catalog.
 pub fn install_global_catalog(
     ctx: &SessionContext,
-    transport: Option<Arc<dyn PeerQueryTransport>>,
+    service: Option<Arc<dyn FanoutService>>,
 ) -> Result<()> {
     let shared_ctx = Arc::new(ctx.clone());
     ctx.register_catalog(
         GLOBAL_CATALOG,
-        Arc::new(DynamicGlobalCatalog::new(shared_ctx, transport)),
+        Arc::new(DynamicGlobalCatalog::new(shared_ctx, service)),
     );
     Ok(())
 }
@@ -32,7 +32,7 @@ pub fn install_global_catalog(
 /// Read-only view over `probe` that exposes federated wrappers for every table.
 struct DynamicGlobalCatalog {
     ctx: Arc<SessionContext>,
-    transport: Option<Arc<dyn PeerQueryTransport>>,
+    service: Option<Arc<dyn FanoutService>>,
 }
 
 impl std::fmt::Debug for DynamicGlobalCatalog {
@@ -44,8 +44,8 @@ impl std::fmt::Debug for DynamicGlobalCatalog {
 }
 
 impl DynamicGlobalCatalog {
-    fn new(ctx: Arc<SessionContext>, transport: Option<Arc<dyn PeerQueryTransport>>) -> Self {
-        Self { ctx, transport }
+    fn new(ctx: Arc<SessionContext>, service: Option<Arc<dyn FanoutService>>) -> Self {
+        Self { ctx, service }
     }
 
     fn probe_catalog(&self) -> Option<Arc<dyn CatalogProvider>> {
@@ -74,7 +74,7 @@ impl CatalogProvider for DynamicGlobalCatalog {
         Some(Arc::new(GlobalSchemaProvider::new(
             name.to_string(),
             inner,
-            self.transport.clone(),
+            self.service.clone(),
         )))
     }
 }
@@ -84,19 +84,19 @@ impl CatalogProvider for DynamicGlobalCatalog {
 struct GlobalSchemaProvider {
     schema_name: String,
     inner: Arc<dyn SchemaProvider>,
-    transport: Option<Arc<dyn PeerQueryTransport>>,
+    service: Option<Arc<dyn FanoutService>>,
 }
 
 impl GlobalSchemaProvider {
     fn new(
         schema_name: String,
         inner: Arc<dyn SchemaProvider>,
-        transport: Option<Arc<dyn PeerQueryTransport>>,
+        service: Option<Arc<dyn FanoutService>>,
     ) -> Self {
         Self {
             schema_name,
             inner,
-            transport,
+            service,
         }
     }
 }
@@ -115,7 +115,7 @@ impl SchemaProvider for GlobalSchemaProvider {
             &self.schema_name,
             name,
             local,
-            self.transport.clone(),
+            self.service.clone(),
         ))))
     }
 
diff --git a/probing/core/src/core/federation/global_table.rs b/probing/core/src/core/federation/global_table.rs
index 5c145160..8f1ea142 100644
--- a/probing/core/src/core/federation/global_table.rs
+++ b/probing/core/src/core/federation/global_table.rs
@@ -1,6 +1,6 @@
 use std::sync::Arc;
 
-use super::cluster_executor::{reset_fanout_stats, PeerQueryTransport, ProbeClusterExecutor};
+use super::cluster_executor::{reset_fanout_stats, FanoutService, ProbeClusterExecutor};
 use super::convert::{
     cluster_rank_for_endpoint, extend_projection_with_probe_tags, federated_output_schema,
 };
@@ -59,7 +59,7 @@ pub struct GlobalFederatedTable {
     schema_name: String,
     table_name: String,
     local: Arc<dyn TableProvider>,
-    transport: Option<Arc<dyn PeerQueryTransport>>,
+    service: Option<Arc<dyn FanoutService>>,
 }
 
 impl GlobalFederatedTable {
@@ -67,13 +67,13 @@ impl GlobalFederatedTable {
         schema_name: impl Into<String>,
         table_name: impl Into<String>,
         local: Arc<dyn TableProvider>,
-        transport: Option<Arc<dyn PeerQueryTransport>>,
+        service: Option<Arc<dyn FanoutService>>,
     ) -> Self {
         Self {
             schema_name: schema_name.into(),
             table_name: table_name.into(),
             local,
-            transport,
+            service,
         }
     }
 }
@@ -142,7 +142,7 @@ impl TableProvider for GlobalFederatedTable {
             addr,
             local_rank,
             current_fanout_stats_handle(),
-            self.transport.clone(),
+            self.service.clone(),
         )?;
         Ok(Arc::new(exec))
     }
diff --git a/probing/core/src/core/federation/mod.rs b/probing/core/src/core/federation/mod.rs
index 3d19bd89..2118b2a4 100644
--- a/probing/core/src/core/federation/mod.rs
+++ b/probing/core/src/core/federation/mod.rs
@@ -18,8 +18,8 @@ pub use cluster_executor::set_remote_query_hook;
 pub use cluster_executor::{
     check_fanout_strict, enforce_fanout_strict, fanout_stats_partial, fanout_strict_enabled,
     remote_fanout_concurrency, remote_query_timeout, reset_fanout_stats, set_fanout_stats,
-    take_fanout_stats, FanoutStats, PeerQueryOutcome, PeerQueryTransport, ProbeClusterExecutor,
-    RemoteFanoutResult,
+    take_fanout_stats, FanoutHttpMethod, FanoutHttpRequest, FanoutHttpResponse, FanoutService,
+    FanoutStats, FanoutTarget, PeerQueryOutcome, ProbeClusterExecutor, RemoteFanoutResult,
 };
 pub use convert::{
     cluster_local_rank_for_endpoint, cluster_node_rank_for_endpoint, cluster_rank_for_endpoint,
diff --git a/probing/core/src/core/memtable_sql.rs b/probing/core/src/core/memtable_sql.rs
index 1a9d7cb5..c7a4454a 100644
--- a/probing/core/src/core/memtable_sql.rs
+++ b/probing/core/src/core/memtable_sql.rs
@@ -64,8 +64,9 @@ use probing_memtable::{
 
 use super::plugin_advanced::{scan_memory_partitions, supports_filters_pushdown_for_schema};
 use super::{
-    EngineError, Maybe, PluginAdvancedTable, ProbeDataSource, ProbeDataSourceKind, ProbeExtension,
-    ProbeExtensionCall, ProbeExtensionOption,
+    EngineError, ExtensionConfigSpec, Maybe, PluginAdvancedTable, ProbeDataSource,
+    ProbeDataSourceKind, ProbeExtension, ProbeExtensionCall, ProbeExtensionConfig,
+    ProbeExtensionOption,
 };
 use probing_macros::ProbeExtension as ProbeExtensionDerive;
 
diff --git a/probing/core/src/core/mod.rs b/probing/core/src/core/mod.rs
index 8b290d6b..e12a2074 100644
--- a/probing/core/src/core/mod.rs
+++ b/probing/core/src/core/mod.rs
@@ -32,9 +32,14 @@ pub use plugin_advanced::PluginAdvancedTable;
 pub use memtable_sql::MemTableProbeExtension;
 pub use memtable_sql::UnifiedMemtableProbeDataSource;
 
+pub use probe_extension::ExtensionConfigSpec;
+pub use probe_extension::ExtensionContentType;
+pub use probe_extension::ExtensionHttpMethod;
+pub use probe_extension::ExtensionRoute;
 pub use probe_extension::Maybe;
 pub use probe_extension::ProbeExtension;
 pub use probe_extension::ProbeExtensionCall;
+pub use probe_extension::ProbeExtensionConfig;
 pub use probe_extension::ProbeExtensionManager;
 pub use probe_extension::ProbeExtensionOption;
 pub use probe_extension::ProbeExtensionResponse;
diff --git a/probing/core/src/core/probe_extension.rs b/probing/core/src/core/probe_extension.rs
index 932d7a73..49485cee 100644
--- a/probing/core/src/core/probe_extension.rs
+++ b/probing/core/src/core/probe_extension.rs
@@ -77,6 +77,88 @@ pub struct ProbeExtensionOption {
     pub help: &'static str,
 }
 
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum ExtensionHttpMethod {
+    Get,
+    Post,
+    Put,
+    Delete,
+}
+
+impl ExtensionHttpMethod {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Get => "GET",
+            Self::Post => "POST",
+            Self::Put => "PUT",
+            Self::Delete => "DELETE",
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum ExtensionContentType {
+    Json,
+    Text,
+    Html,
+}
+
+impl ExtensionContentType {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Json => "application/json",
+            Self::Text => "text/plain",
+            Self::Html => "text/html",
+        }
+    }
+}
+
+/// Static HTTP contract published by an extension.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct ExtensionRoute {
+    /// Extension-local path without a leading slash.
+    pub path: &'static str,
+    pub method: ExtensionHttpMethod,
+    pub content_type: ExtensionContentType,
+    pub cors: bool,
+    pub requires_engine_ready: bool,
+}
+
+impl ExtensionRoute {
+    pub const fn new(
+        path: &'static str,
+        method: ExtensionHttpMethod,
+        content_type: ExtensionContentType,
+    ) -> Self {
+        Self {
+            path,
+            method,
+            content_type,
+            cors: false,
+            requires_engine_ready: false,
+        }
+    }
+
+    pub const fn with_cors(mut self) -> Self {
+        self.cors = true;
+        self
+    }
+
+    pub const fn requiring_engine(mut self) -> Self {
+        self.requires_engine_ready = true;
+        self
+    }
+}
+
+/// Static configuration contract published by an extension.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct ExtensionConfigSpec {
+    /// Extension-local canonical key.
+    pub key: &'static str,
+    pub aliases: &'static [&'static str],
+    pub help: &'static str,
+}
+
 /// Body plus transport-neutral completeness metadata returned by an extension.
 #[derive(Clone, Debug, Default, PartialEq, Eq)]
 pub struct ProbeExtensionResponse {
@@ -98,6 +180,12 @@ impl From<Vec<u8>> for ProbeExtensionResponse {
 #[allow(unused)]
 #[async_trait]
 pub trait ProbeExtensionCall: Debug + Send + Sync {
+    /// HTTP routes owned by this extension. Registration validates and indexes
+    /// these contracts before the engine becomes visible.
+    fn routes(&self) -> Vec<ExtensionRoute> {
+        Vec::new()
+    }
+
     /// Handle API calls to the extension
     ///
     /// # Arguments
@@ -128,22 +216,32 @@ pub trait ProbeExtensionCall: Debug + Send + Sync {
     }
 }
 
-/// Configurable Probing extension: HTTP calls, SET options, and runtime side effects.
-///
-/// SQL catalog registration is separate — use [`ProbeDataSource`] via
-/// [`super::engine::EngineBuilder::with_data_source`].
-#[allow(unused)]
-pub trait ProbeExtension: Debug + Send + Sync + ProbeExtensionCall {
-    fn name(&self) -> String;
+/// Runtime configuration contract, intentionally independent from HTTP calls.
+pub trait ProbeExtensionConfig: Debug + Send + Sync {
     fn set(&mut self, key: &str, _value: &str) -> Result<String, EngineError> {
         Err(EngineError::UnsupportedOption(key.to_string()))
     }
+
     fn get(&self, key: &str) -> Result<String, EngineError> {
         Err(EngineError::UnsupportedOption(key.to_string()))
     }
+
     fn options(&self) -> Vec<ProbeExtensionOption> {
         Vec::new()
     }
+
+    fn config_specs(&self) -> &'static [ExtensionConfigSpec] {
+        &[]
+    }
+}
+
+/// Configurable Probing extension: HTTP calls, SET options, and runtime side effects.
+///
+/// SQL catalog registration is separate — use [`ProbeDataSource`] via
+/// [`super::engine::EngineBuilder::with_data_source`].
+#[allow(unused)]
+pub trait ProbeExtension: Debug + Send + Sync + ProbeExtensionCall + ProbeExtensionConfig {
+    fn name(&self) -> String;
 }
 
 /// Engine extension management module for configurable functionality.
@@ -164,7 +262,7 @@ pub trait ProbeExtension: Debug + Send + Sync + ProbeExtensionCall {
 /// use std::sync::Arc;
 /// use tokio::sync::Mutex;
 /// use probing_core::core::ProbeExtensionManager;
-/// use probing_core::core::{ProbeExtension, ProbeExtensionOption, ProbeExtensionCall, EngineError};
+/// use probing_core::core::{EngineError, ExtensionConfigSpec, ProbeExtension, ProbeExtensionConfig, ProbeExtensionOption, ProbeExtensionCall};
 ///
 /// #[derive(Debug)]
 /// struct MyExtension {
@@ -177,6 +275,12 @@ pub trait ProbeExtension: Debug + Send + Sync + ProbeExtensionCall {
 ///     fn name(&self) -> String {
 ///         "my_extension".to_string() // This name is used to form the option namespace
 ///     }
+/// }
+///
+/// impl ProbeExtensionConfig for MyExtension {
+///     fn config_specs(&self) -> &'static [ExtensionConfigSpec] {
+///         &[ExtensionConfigSpec { key: "some_option", aliases: &[], help: "An example option" }]
+///     }
 ///
 ///     fn set(&mut self, key: &str, value: &str) -> Result<String, EngineError> {
 ///         match key {
@@ -210,12 +314,11 @@ pub trait ProbeExtension: Debug + Send + Sync + ProbeExtensionCall {
 /// // This example demonstrates usage within an async context.
 /// # async fn manager_usage_example() -> Result<(), EngineError> {
 ///     let mut manager = ProbeExtensionManager::default();
-///     // Register extensions. The first argument "my_ext_instance_key" is an internal key for the manager
-///     // and does not directly affect option key formation for set_option/get_option.
+///     // Registration keys must match the extension's declared name.
 ///     manager.register(
-///         "my_ext_instance_key".to_string(),
+///         "my_extension".to_string(),
 ///         Arc::new(Mutex::new(MyExtension { some_option: "default".to_string() }))
-///     );
+///     ).await?;
 ///
 ///     // Configure extensions. The option key is "<extension_name>.<local_option_key>".
 ///     // MyExtension::name() returns "my_extension". The local key is "some_option".
@@ -248,12 +351,28 @@ pub trait ProbeExtension: Debug + Send + Sync + ProbeExtensionCall {
 #[derive(Clone, Debug)]
 pub struct ProbeExtensionManager {
     extensions: Arc<RwLock<ProbeExtensionMap>>,
+    routes: Arc<RwLock<BTreeMap<String, RegisteredExtensionRoute>>>,
+    configs: Arc<RwLock<BTreeMap<String, RegisteredExtensionConfig>>>,
+}
+
+#[derive(Clone, Debug)]
+struct RegisteredExtensionRoute {
+    extension: Arc<Mutex<dyn ProbeExtension + Send + Sync>>,
+    contract: ExtensionRoute,
+}
+
+#[derive(Clone, Debug)]
+struct RegisteredExtensionConfig {
+    extension: Arc<Mutex<dyn ProbeExtension + Send + Sync>>,
+    local_key: &'static str,
 }
 
 impl Default for ProbeExtensionManager {
     fn default() -> Self {
         Self {
             extensions: Arc::new(RwLock::new(BTreeMap::new())),
+            routes: Arc::new(RwLock::new(BTreeMap::new())),
+            configs: Arc::new(RwLock::new(BTreeMap::new())),
         }
     }
 }
@@ -264,8 +383,95 @@ impl ProbeExtensionManager {
         &mut self,
         name: String,
         extension: Arc<Mutex<dyn ProbeExtension + Send + Sync>>,
-    ) {
-        self.extensions.write().await.insert(name, extension);
+    ) -> Result<(), EngineError> {
+        let (actual_name, contracts, config_specs) = {
+            let extension = extension.lock().await;
+            (
+                extension.name(),
+                extension.routes(),
+                extension.config_specs().to_vec(),
+            )
+        };
+        validate_extension_name(&actual_name)?;
+        if name != actual_name {
+            return Err(EngineError::config(format!(
+                "extension registration key '{name}' does not match declared name '{actual_name}'"
+            )));
+        }
+        validate_config_specs(&actual_name, &config_specs)?;
+
+        let config_namespace = Self::extract_namespace(&actual_name);
+        let mut indexed_configs = Vec::new();
+        for spec in config_specs {
+            indexed_configs.push((format!("{config_namespace}{}", spec.key), spec.key));
+            indexed_configs.extend(
+                spec.aliases
+                    .iter()
+                    .map(|alias| (format!("{config_namespace}{alias}"), *alias)),
+            );
+        }
+
+        let mut indexed = Vec::with_capacity(contracts.len());
+        for contract in contracts {
+            validate_route(&actual_name, contract)?;
+            let full_path = extension_route_key(&actual_name, contract.path);
+            if indexed.iter().any(|(path, _)| path == &full_path) {
+                return Err(EngineError::config(format!(
+                    "extension '{actual_name}' declares duplicate route '/{full_path}'"
+                )));
+            }
+            indexed.push((full_path, contract));
+        }
+
+        let mut extensions = self.extensions.write().await;
+        if extensions.contains_key(&actual_name) {
+            return Err(EngineError::config(format!(
+                "duplicate extension name '{actual_name}'"
+            )));
+        }
+        let mut routes = self.routes.write().await;
+        if let Some((path, _)) = indexed.iter().find(|(path, _)| routes.contains_key(path)) {
+            return Err(EngineError::config(format!(
+                "duplicate extension route '/{path}'"
+            )));
+        }
+        let mut configs = self.configs.write().await;
+        if let Some((key, _)) = indexed_configs
+            .iter()
+            .find(|(key, _)| configs.contains_key(key))
+        {
+            return Err(EngineError::config(format!(
+                "duplicate registered extension config key '{key}'"
+            )));
+        }
+        extensions.insert(actual_name, extension.clone());
+        for (path, contract) in indexed {
+            routes.insert(
+                path,
+                RegisteredExtensionRoute {
+                    extension: extension.clone(),
+                    contract,
+                },
+            );
+        }
+        for (key, local_key) in indexed_configs {
+            configs.insert(
+                key,
+                RegisteredExtensionConfig {
+                    extension: extension.clone(),
+                    local_key,
+                },
+            );
+        }
+        Ok(())
+    }
+
+    pub async fn route(&self, path: &str) -> Option<ExtensionRoute> {
+        self.routes
+            .read()
+            .await
+            .get(&normalize_route_key(path))
+            .map(|route| route.contract)
     }
 
     /// Extract namespace from extension name by removing "extension" suffix and converting to lowercase
@@ -282,40 +488,17 @@ impl ProbeExtensionManager {
     /// This is the core implementation that updates extension configuration.
     /// ConfigStore is not updated by this method.
     pub async fn set_option(&mut self, key: &str, value: &str) -> Result<(), EngineError> {
-        let extensions_clone: Vec<_> = {
-            let extensions = self.extensions.read().await;
-            extensions.values().cloned().collect()
-        }; // Lock is released here
-
-        for extension in extensions_clone {
-            let namespace = {
-                let ext = extension.lock().await;
-                Self::extract_namespace(&ext.name())
-            };
-
-            if !key.starts_with(&namespace) {
-                continue;
-            }
-
-            let local_key = key.trim_start_matches(&namespace).to_string();
-            let result = {
-                let mut ext = extension.lock().await;
-                ext.set(&local_key, value)
-            };
-
-            match result {
-                Ok(old) => {
-                    log::info!(
-                        "setting update [{}]:{local_key}={value} <= {old}",
-                        namespace.trim_end_matches('.')
-                    );
-                    return Ok(());
-                }
-                Err(EngineError::UnsupportedOption(_)) => continue,
-                Err(e) => return Err(e),
-            }
-        }
-        Err(EngineError::UnsupportedOption(key.to_string()))
+        let registered = self
+            .configs
+            .read()
+            .await
+            .get(key)
+            .cloned()
+            .ok_or_else(|| EngineError::UnsupportedOption(key.to_string()))?;
+        let mut extension = registered.extension.lock().await;
+        let old = extension.set(registered.local_key, value)?;
+        log::info!("setting update [{key}]={value} <= {old}");
+        Ok(())
     }
 
     /// Set an option and update ConfigStore.
@@ -334,28 +517,17 @@ impl ProbeExtensionManager {
     }
 
     pub async fn get_option(&self, key: &str) -> Result<String, EngineError> {
-        let extensions_clone: Vec<_> = {
-            let extensions = self.extensions.read().await;
-            extensions.values().cloned().collect()
-        }; // Lock is released here
-
-        for extension in extensions_clone {
-            let ext = extension.lock().await;
-            let namespace = Self::extract_namespace(&ext.name());
-            if !key.starts_with(&namespace) {
-                continue;
-            }
-            let local_key = key.trim_start_matches(&namespace);
-            match ext.get(local_key) {
-                Ok(value) => {
-                    log::info!("setting read [{}]:{local_key}={value}", ext.name());
-                    return Ok(value);
-                }
-                Err(EngineError::UnsupportedOption(_)) => continue,
-                Err(e) => return Err(e),
-            }
-        }
-        Err(EngineError::UnsupportedOption(key.to_string()))
+        let registered = self
+            .configs
+            .read()
+            .await
+            .get(key)
+            .cloned()
+            .ok_or_else(|| EngineError::UnsupportedOption(key.to_string()))?;
+        let extension = registered.extension.lock().await;
+        let value = extension.get(registered.local_key)?;
+        log::info!("setting read [{key}]={value}");
+        Ok(value)
     }
 
     pub async fn options(&self) -> Vec<ProbeExtensionOption> {
@@ -389,57 +561,81 @@ impl ProbeExtensionManager {
         params: &HashMap<String, String>,
         body: &[u8],
     ) -> Result<ProbeExtensionResponse, EngineError> {
-        let extensions_clone: Vec<_> = {
-            let extensions = self.extensions.read().await;
-            extensions.values().cloned().collect()
-        }; // Lock is released here
+        let registered = self
+            .routes
+            .read()
+            .await
+            .get(&normalize_route_key(path))
+            .cloned()
+            .ok_or_else(|| EngineError::CallError(format!("API call error: {path}")))?;
+        let extension = registered.extension.lock().await;
+        extension
+            .call_response(registered.contract.path, params, body)
+            .await
+    }
+}
 
-        for extension in extensions_clone {
-            let ext = extension.lock().await;
-            let name = ext.name();
-            let expected_prefix = format!("/{name}/");
+fn normalize_route_key(path: &str) -> String {
+    path.trim().trim_matches('/').to_ascii_lowercase()
+}
 
-            // Also check without leading slash for flexibility
-            let expected_prefix_no_slash = format!("{name}/");
+fn extension_route_key(extension_name: &str, local_path: &str) -> String {
+    let local_path = local_path.trim_matches('/');
+    if local_path.is_empty() {
+        normalize_route_key(extension_name)
+    } else {
+        normalize_route_key(&format!("{extension_name}/{local_path}"))
+    }
+}
 
-            let (matched, local_path) = if path.starts_with(&expected_prefix) {
-                (true, path[expected_prefix.len()..].to_string())
-            } else if path.starts_with(&expected_prefix_no_slash) {
-                (true, path[expected_prefix_no_slash.len()..].to_string())
-            } else {
-                (false, String::new())
-            };
+fn validate_extension_name(name: &str) -> Result<(), EngineError> {
+    if name.is_empty()
+        || name != name.to_ascii_lowercase()
+        || !name
+            .bytes()
+            .all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit() || byte == b'_')
+    {
+        return Err(EngineError::config(format!(
+            "invalid extension name '{name}': use lowercase ASCII letters, digits, or '_'"
+        )));
+    }
+    Ok(())
+}
 
-            if !matched {
-                continue;
-            }
+fn validate_route(extension_name: &str, route: ExtensionRoute) -> Result<(), EngineError> {
+    if route.path.starts_with('/')
+        || route.path.ends_with('/')
+        || route.path.contains("..")
+        || route.path.contains(['?', '#'])
+    {
+        return Err(EngineError::config(format!(
+            "invalid route path '{}' declared by extension '{extension_name}'",
+            route.path
+        )));
+    }
+    Ok(())
+}
 
-            log::debug!("checking extension [{name}]:{path}");
-            log::debug!("Extension [{name}] matched, local_path: {}", local_path);
-
-            // Call the extension while preserving response completeness metadata.
-            match ext.call_response(&local_path, params, body).await {
-                Ok(value) => return Ok(value),
-                Err(EngineError::UnsupportedCall) => {
-                    log::debug!(
-                        "Extension [{name}] returned UnsupportedCall for path: {}",
-                        local_path
-                    );
-                    continue;
-                }
-                Err(e) => {
-                    log::error!(
-                        "Extension [{name}] call failed for path '{}': {}",
-                        local_path,
-                        e
-                    );
-                    return Err(e);
-                }
+fn validate_config_specs(
+    extension_name: &str,
+    specs: &[ExtensionConfigSpec],
+) -> Result<(), EngineError> {
+    let mut keys = std::collections::BTreeSet::new();
+    for spec in specs {
+        for key in std::iter::once(spec.key).chain(spec.aliases.iter().copied()) {
+            if key.is_empty() || key.starts_with('.') || key.ends_with('.') || key.contains("..") {
+                return Err(EngineError::config(format!(
+                    "invalid config key '{key}' declared by extension '{extension_name}'"
+                )));
+            }
+            if !keys.insert(key) {
+                return Err(EngineError::config(format!(
+                    "duplicate config key or alias '{key}' in extension '{extension_name}'"
+                )));
             }
         }
-        log::error!("No extension matched path: {}", path);
-        Err(EngineError::CallError(format!("API call error: {}", path)))
     }
+    Ok(())
 }
 
 impl ConfigExtension for ProbeExtensionManager {
@@ -527,6 +723,16 @@ mod tests {
         fn name(&self) -> String {
             "test".to_string()
         }
+    }
+
+    impl ProbeExtensionConfig for TestExtension {
+        fn config_specs(&self) -> &'static [ExtensionConfigSpec] {
+            &[ExtensionConfigSpec {
+                key: "option",
+                aliases: &[],
+                help: "Test option",
+            }]
+        }
 
         fn set(&mut self, key: &str, value: &str) -> Result<String, EngineError> {
             match key {
@@ -560,6 +766,14 @@ mod tests {
 
     #[async_trait]
     impl ProbeExtensionCall for PartialResponseExtension {
+        fn routes(&self) -> Vec<ExtensionRoute> {
+            vec![ExtensionRoute::new(
+                "data",
+                ExtensionHttpMethod::Get,
+                ExtensionContentType::Text,
+            )]
+        }
+
         async fn call_response(
             &self,
             _path: &str,
@@ -579,6 +793,83 @@ mod tests {
         }
     }
 
+    impl ProbeExtensionConfig for PartialResponseExtension {}
+
+    #[derive(Debug)]
+    struct InvalidContractExtension {
+        duplicate_config: bool,
+    }
+
+    impl ProbeExtensionCall for InvalidContractExtension {
+        fn routes(&self) -> Vec<ExtensionRoute> {
+            vec![
+                ExtensionRoute::new("same", ExtensionHttpMethod::Get, ExtensionContentType::Json),
+                ExtensionRoute::new(
+                    "same",
+                    ExtensionHttpMethod::Post,
+                    ExtensionContentType::Text,
+                ),
+            ]
+        }
+    }
+
+    impl ProbeExtensionConfig for InvalidContractExtension {
+        fn config_specs(&self) -> &'static [ExtensionConfigSpec] {
+            if self.duplicate_config {
+                &[
+                    ExtensionConfigSpec {
+                        key: "sample",
+                        aliases: &["rate"],
+                        help: "sample",
+                    },
+                    ExtensionConfigSpec {
+                        key: "other",
+                        aliases: &["rate"],
+                        help: "other",
+                    },
+                ]
+            } else {
+                &[]
+            }
+        }
+    }
+
+    impl ProbeExtension for InvalidContractExtension {
+        fn name(&self) -> String {
+            "invalid".into()
+        }
+    }
+
+    #[tokio::test]
+    async fn registration_rejects_duplicate_routes() {
+        let mut manager = ProbeExtensionManager::default();
+        let error = manager
+            .register(
+                "invalid".into(),
+                Arc::new(Mutex::new(InvalidContractExtension {
+                    duplicate_config: false,
+                })),
+            )
+            .await
+            .unwrap_err();
+        assert!(error.to_string().contains("duplicate route"));
+    }
+
+    #[tokio::test]
+    async fn registration_rejects_duplicate_config_aliases() {
+        let mut manager = ProbeExtensionManager::default();
+        let error = manager
+            .register(
+                "invalid".into(),
+                Arc::new(Mutex::new(InvalidContractExtension {
+                    duplicate_config: true,
+                })),
+            )
+            .await
+            .unwrap_err();
+        assert!(error.to_string().contains("duplicate config key or alias"));
+    }
+
     #[tokio::test]
     async fn call_response_preserves_extension_metadata() {
         let mut manager = ProbeExtensionManager::default();
@@ -587,7 +878,8 @@ mod tests {
                 "partial".to_string(),
                 Arc::new(Mutex::new(PartialResponseExtension)),
             )
-            .await;
+            .await
+            .unwrap();
 
         let response = manager
             .call_response("/partial/data", &HashMap::new(), &[])
@@ -606,7 +898,8 @@ mod tests {
         let extension = Arc::new(Mutex::new(TestExtension::default()));
         manager
             .register("test".to_string(), extension.clone())
-            .await;
+            .await
+            .unwrap();
 
         // Set option through manager using set_option_with_store_update
         manager
@@ -636,7 +929,10 @@ mod tests {
 
         let mut manager = ProbeExtensionManager::default();
         let extension = Arc::new(Mutex::new(TestExtension::default()));
-        manager.register("test".to_string(), extension).await;
+        manager
+            .register("test".to_string(), extension)
+            .await
+            .unwrap();
 
         // Set option through manager using set_option_with_store_update
         manager
@@ -657,7 +953,10 @@ mod tests {
 
         let mut manager = ProbeExtensionManager::default();
         let extension = Arc::new(Mutex::new(TestExtension::default()));
-        manager.register("test".to_string(), extension).await;
+        manager
+            .register("test".to_string(), extension)
+            .await
+            .unwrap();
 
         // Try to set unsupported key
         let result = manager.set_option("test.invalid", "value").await;
@@ -696,7 +995,8 @@ mod tests {
                 "test".to_string(),
                 Arc::new(Mutex::new(TestExtension::default())),
             )
-            .await;
+            .await
+            .unwrap();
 
         first.set_option("test.option", "first").await.unwrap();
         assert_eq!(first.get_option("test.option").await.unwrap(), "first");
diff --git a/probing/extensions/cc/src/extensions/cpu/extension.rs b/probing/extensions/cc/src/extensions/cpu/extension.rs
index b6c2b6a3..69309129 100644
--- a/probing/extensions/cc/src/extensions/cpu/extension.rs
+++ b/probing/extensions/cc/src/extensions/cpu/extension.rs
@@ -3,6 +3,7 @@ use probing_core::core::Maybe;
 use probing_core::core::ProbeExtension;
 use probing_core::core::ProbeExtensionCall;
 use probing_core::core::ProbeExtensionOption;
+use probing_core::core::{ExtensionConfigSpec, ProbeExtensionConfig};
 
 use super::collector::start_cpu_sampling;
 
diff --git a/probing/extensions/cc/src/extensions/rdma.rs b/probing/extensions/cc/src/extensions/rdma.rs
index 5ba21ee0..95bd6ce0 100644
--- a/probing/extensions/cc/src/extensions/rdma.rs
+++ b/probing/extensions/cc/src/extensions/rdma.rs
@@ -2,6 +2,10 @@ use probing_core::core::EngineError;
 use probing_core::core::Maybe;
 use probing_core::core::ProbeExtension;
 use probing_core::core::ProbeExtensionOption;
+use probing_core::core::{
+    ExtensionConfigSpec, ExtensionContentType, ExtensionHttpMethod, ExtensionRoute,
+    ProbeExtensionConfig,
+};
 use probing_core::sync::lock_mutex;
 
 use datafusion::arrow::array::{GenericStringBuilder, RecordBatch};
@@ -134,6 +138,14 @@ pub struct RdmaProbeExtension {
 
 #[async_trait]
 impl ProbeExtensionCall for RdmaProbeExtension {
+    fn routes(&self) -> Vec<ExtensionRoute> {
+        vec![ExtensionRoute::new(
+            "",
+            ExtensionHttpMethod::Post,
+            ExtensionContentType::Text,
+        )]
+    }
+
     async fn call(
         &self,
         path: &str,
diff --git a/probing/extensions/gpu/src/extensions/extension.rs b/probing/extensions/gpu/src/extensions/extension.rs
index 5f1e8010..4b3cb851 100644
--- a/probing/extensions/gpu/src/extensions/extension.rs
+++ b/probing/extensions/gpu/src/extensions/extension.rs
@@ -3,6 +3,7 @@ use probing_core::core::Maybe;
 use probing_core::core::ProbeExtension;
 use probing_core::core::ProbeExtensionCall;
 use probing_core::core::ProbeExtensionOption;
+use probing_core::core::{ExtensionConfigSpec, ProbeExtensionConfig};
 
 use super::collector::start_gpu_sampling;
 
diff --git a/probing/extensions/python/Cargo.toml b/probing/extensions/python/Cargo.toml
index f8487abb..ca52ce14 100644
--- a/probing/extensions/python/Cargo.toml
+++ b/probing/extensions/python/Cargo.toml
@@ -29,7 +29,6 @@ serde_json = { workspace = true }
 sha2 = "0.10"
 uuid = { version = "1.0", features = ["v4"] }
 tokio = { workspace = true }
-ureq = { workspace = true }
 html-escape = "0.2"
 
 include_dir = "=0.7.4"
diff --git a/probing/extensions/python/src/extensions/pprof.rs b/probing/extensions/python/src/extensions/pprof.rs
index 3cd6f4d2..6799767b 100644
--- a/probing/extensions/python/src/extensions/pprof.rs
+++ b/probing/extensions/python/src/extensions/pprof.rs
@@ -1,22 +1,63 @@
 use std::collections::HashMap;
+use std::sync::Arc;
 
 use async_trait::async_trait;
+use probing_core::core::federation::FanoutService;
 use probing_core::core::EngineError;
 use probing_core::core::Maybe;
 use probing_core::core::ProbeExtension;
 use probing_core::core::ProbeExtensionCall;
 use probing_core::core::ProbeExtensionOption;
 use probing_core::core::ProbeExtensionResponse;
+use probing_core::core::{
+    ExtensionConfigSpec, ExtensionContentType, ExtensionHttpMethod, ExtensionRoute,
+    ProbeExtensionConfig,
+};
 
-#[derive(Debug, Default, ProbeExtension)]
+#[derive(Debug, ProbeExtension)]
 pub struct PprofProbeExtension {
     /// CPU profiling sample frequency in Hz (higher values increase overhead)
     #[option(aliases=["sample.freq"])]
     sample_freq: Maybe<i32>,
+    fanout_service: Option<Arc<dyn FanoutService>>,
+}
+
+impl Default for PprofProbeExtension {
+    fn default() -> Self {
+        Self {
+            sample_freq: Maybe::Nothing,
+            fanout_service: None,
+        }
+    }
 }
 
 #[async_trait]
 impl ProbeExtensionCall for PprofProbeExtension {
+    fn routes(&self) -> Vec<ExtensionRoute> {
+        vec![
+            ExtensionRoute::new(
+                "flamegraph",
+                ExtensionHttpMethod::Get,
+                ExtensionContentType::Html,
+            ),
+            ExtensionRoute::new(
+                "flamegraph/json",
+                ExtensionHttpMethod::Get,
+                ExtensionContentType::Json,
+            ),
+            ExtensionRoute::new(
+                "flamegraph/folded/json",
+                ExtensionHttpMethod::Get,
+                ExtensionContentType::Json,
+            ),
+            ExtensionRoute::new(
+                "flamegraph/distributed/json",
+                ExtensionHttpMethod::Get,
+                ExtensionContentType::Json,
+            ),
+        ]
+    }
+
     async fn call(
         &self,
         path: &str,
@@ -55,6 +96,13 @@ impl ProbeExtensionCall for PprofProbeExtension {
 }
 
 impl PprofProbeExtension {
+    pub fn with_fanout_service(fanout_service: Arc<dyn FanoutService>) -> Self {
+        Self {
+            fanout_service: Some(fanout_service),
+            ..Self::default()
+        }
+    }
+
     async fn distributed_flamegraph_response(
         &self,
         params: &HashMap<String, String>,
@@ -63,7 +111,9 @@ impl PprofProbeExtension {
         let mode = super::one_of_param(params, "mode", "mixed", &["mixed", "py"])?;
         let (body, partial) =
             crate::features::stacktrace::tracers::pprof::collect_distributed_stack_flamegraph_json(
-                cluster, mode,
+                self.fanout_service.clone(),
+                cluster,
+                mode,
             )
             .await;
         Ok(ProbeExtensionResponse {
diff --git a/probing/extensions/python/src/extensions/python.rs b/probing/extensions/python/src/extensions/python.rs
index e7d0cb28..b159f481 100644
--- a/probing/extensions/python/src/extensions/python.rs
+++ b/probing/extensions/python/src/extensions/python.rs
@@ -9,6 +9,10 @@ use probing_core::core::ProbeExtension;
 use probing_core::core::ProbeExtensionCall;
 use probing_core::core::ProbeExtensionOption;
 use probing_core::core::Result as EngineResult;
+use probing_core::core::{
+    ExtensionConfigSpec, ExtensionContentType, ExtensionHttpMethod, ExtensionRoute,
+    ProbeExtensionConfig,
+};
 use probing_core::run_on_native_thread;
 use probing_proto::prelude::CallFrame;
 use pyo3::prelude::*;
@@ -70,6 +74,44 @@ pub struct PythonExt {
 
 #[async_trait]
 impl ProbeExtensionCall for PythonExt {
+    fn routes(&self) -> Vec<ExtensionRoute> {
+        use ExtensionContentType::Json;
+        use ExtensionHttpMethod::{Get, Post};
+        vec![
+            ExtensionRoute::new("callstack", Get, Json),
+            ExtensionRoute::new("eval", Post, ExtensionContentType::Text),
+            ExtensionRoute::new("trace/list", Get, Json),
+            ExtensionRoute::new("trace/show", Get, Json),
+            ExtensionRoute::new("trace/start", Get, Json),
+            ExtensionRoute::new("trace/stop", Get, Json),
+            ExtensionRoute::new("trace/variables", Get, Json),
+            ExtensionRoute::new("trace/chrome-tracing", Get, Json).with_cors(),
+            ExtensionRoute::new("pytorch/timeline", Get, Json).with_cors(),
+            ExtensionRoute::new("pytorch/profile", Get, Json),
+            ExtensionRoute::new("pytorch/profile/start", Get, Json),
+            ExtensionRoute::new("pytorch/profile/stop", Get, Json),
+            ExtensionRoute::new("pytorch/profile/status", Get, Json),
+            ExtensionRoute::new("pytorch/runtime-debug", Get, Json),
+            ExtensionRoute::new("ray/timeline", Get, Json).with_cors(),
+            ExtensionRoute::new("ray/timeline/chrome", Get, Json).with_cors(),
+            ExtensionRoute::new("magics", Get, Json),
+            ExtensionRoute::new("flight-recorder/snapshot", Get, Json),
+            ExtensionRoute::new("crash/hold", Get, Json),
+            ExtensionRoute::new("crash/release", Get, Json),
+            ExtensionRoute::new("skills/list", Get, Json),
+            ExtensionRoute::new("skills/load", Get, Json),
+            ExtensionRoute::new("skills/catalog", Get, Json),
+            ExtensionRoute::new("skills/routing", Get, Json),
+            ExtensionRoute::new("skills/roots", Get, Json),
+            ExtensionRoute::new("extensions/list", Get, Json),
+            ExtensionRoute::new("engines/register", Get, Json),
+            ExtensionRoute::new("engines/register_slime", Get, Json),
+            ExtensionRoute::new("engines/list", Get, Json),
+            ExtensionRoute::new("engines/scrape", Get, Json),
+            ExtensionRoute::new("engines/snapshot", Get, Json),
+        ]
+    }
+
     async fn call(
         &self,
         path: &str,
diff --git a/probing/extensions/python/src/extensions/torch.rs b/probing/extensions/python/src/extensions/torch.rs
index 98b16764..d3b30d7b 100644
--- a/probing/extensions/python/src/extensions/torch.rs
+++ b/probing/extensions/python/src/extensions/torch.rs
@@ -7,6 +7,10 @@ use probing_core::core::ProbeExtension;
 use probing_core::core::ProbeExtensionCall;
 use probing_core::core::ProbeExtensionOption;
 use probing_core::core::ProbeExtensionResponse;
+use probing_core::core::{
+    ExtensionConfigSpec, ExtensionContentType, ExtensionHttpMethod, ExtensionRoute,
+    ProbeExtensionConfig,
+};
 use pyo3::prelude::*;
 
 #[derive(Debug, Default, ProbeExtension)]
@@ -18,6 +22,27 @@ pub struct TorchProbeExtension {
 
 #[async_trait]
 impl ProbeExtensionCall for TorchProbeExtension {
+    fn routes(&self) -> Vec<ExtensionRoute> {
+        vec![
+            ExtensionRoute::new(
+                "flamegraph",
+                ExtensionHttpMethod::Get,
+                ExtensionContentType::Html,
+            ),
+            ExtensionRoute::new(
+                "flamegraph/json",
+                ExtensionHttpMethod::Get,
+                ExtensionContentType::Json,
+            ),
+            ExtensionRoute::new(
+                "flamegraph/distributed/json",
+                ExtensionHttpMethod::Get,
+                ExtensionContentType::Json,
+            )
+            .requiring_engine(),
+        ]
+    }
+
     async fn call(
         &self,
         path: &str,
diff --git a/probing/extensions/python/src/features/python/bindings.rs b/probing/extensions/python/src/features/python/bindings.rs
index 47e14903..1ba4c708 100644
--- a/probing/extensions/python/src/features/python/bindings.rs
+++ b/probing/extensions/python/src/features/python/bindings.rs
@@ -36,13 +36,32 @@ pub fn is_enabled() -> bool {
 #[pyfunction]
 pub fn query_json(_py: Python, sql: String) -> PyResult<String> {
     with_detached_native(move || {
-        let bridge = block_on(async move { ENGINE.read().await.async_query(sql.as_str()).await })
+        let bridge = block_on(async move { ENGINE.read().await.query_outcome(sql.as_str()).await })
             .map_err(|e| runtime_err(format!("probing runtime unavailable: {e}")))?;
         match bridge {
-            Ok(Some(df)) => serde_json::to_string(&df).map_err(runtime_err),
-            Ok(None) => Err(pyo3::exceptions::PyRuntimeError::new_err(
-                "query returned nil (no tabular result; e.g. SET or non-SELECT)",
-            )),
+            Ok(outcome) if outcome.quality.is_partial() => Err(runtime_err(format!(
+                "federated query returned partial data: {:?}",
+                outcome.quality
+            ))),
+            Ok(outcome) => match outcome.data {
+                Some(df) => serde_json::to_string(&df).map_err(runtime_err),
+                None => Err(pyo3::exceptions::PyRuntimeError::new_err(
+                    "query returned nil (no tabular result; e.g. SET or non-SELECT)",
+                )),
+            },
+            Err(e) => Err(runtime_err(format!("engine SQL failed: {e}"))),
+        }
+    })
+}
+
+/// Execute SQL and serialize the typed data + completeness contract.
+#[pyfunction]
+pub fn query_outcome_json(_py: Python, sql: String) -> PyResult<String> {
+    with_detached_native(move || {
+        let bridge = block_on(async move { ENGINE.read().await.query_outcome(sql.as_str()).await })
+            .map_err(|e| runtime_err(format!("probing runtime unavailable: {e}")))?;
+        match bridge {
+            Ok(outcome) => serde_json::to_string(&outcome).map_err(runtime_err),
             Err(e) => Err(runtime_err(format!("engine SQL failed: {e}"))),
         }
     })
diff --git a/probing/extensions/python/src/features/stacktrace/tracers/pprof.rs b/probing/extensions/python/src/features/stacktrace/tracers/pprof.rs
index e8f911dc..70845721 100644
--- a/probing/extensions/python/src/features/stacktrace/tracers/pprof.rs
+++ b/probing/extensions/python/src/features/stacktrace/tracers/pprof.rs
@@ -791,60 +791,35 @@ fn unique_contributor_rank_count(sets: &[(Option<i32>, Vec<String>)]) -> usize {
     ranks.len() + unranked
 }
 
-fn remote_pprof_folded_lines_blocking(addr: &str) -> anyhow::Result<Vec<String>> {
-    let url = format!("http://{addr}/apis/pprofextension/flamegraph/folded/json");
-    let timeout = std::time::Duration::from_secs(
-        std::env::var("PROBING_CLUSTER_QUERY_TIMEOUT_SEC")
-            .ok()
-            .and_then(|v| v.parse().ok())
-            .unwrap_or(10),
-    );
-    let text = ureq::get(&url)
-        .config()
-        .timeout_global(Some(timeout))
-        .build()
-        .call()?
-        .body_mut()
-        .read_to_string()?;
+fn decode_remote_folded(
+    response: probing_core::core::federation::FanoutHttpResponse,
+) -> anyhow::Result<Vec<String>> {
+    if response.status >= 400 {
+        anyhow::bail!(
+            "HTTP {}: {}",
+            response.status,
+            String::from_utf8_lossy(&response.body)
+        );
+    }
     #[derive(serde::Deserialize)]
     struct Payload {
         lines: Vec<String>,
     }
-    Ok(serde_json::from_str::<Payload>(&text)?.lines)
-}
-
-fn remote_pprof_flamegraph_json_blocking(addr: &str) -> anyhow::Result<String> {
-    let url = format!("http://{addr}/apis/pprofextension/flamegraph/json");
-    let timeout = std::time::Duration::from_secs(
-        std::env::var("PROBING_CLUSTER_QUERY_TIMEOUT_SEC")
-            .ok()
-            .and_then(|v| v.parse().ok())
-            .unwrap_or(10),
-    );
-    let text = ureq::get(&url)
-        .config()
-        .timeout_global(Some(timeout))
-        .build()
-        .call()?
-        .body_mut()
-        .read_to_string()?;
-    Ok(text)
+    Ok(serde_json::from_slice::<Payload>(&response.body)?.lines)
 }
 
-fn remote_pprof_folded_lines_fallback(addr: &str) -> anyhow::Result<Vec<String>> {
-    remote_pprof_folded_lines_blocking(addr).or_else(|_| {
-        let json = remote_pprof_flamegraph_json_blocking(addr)?;
-        Ok(crate::features::flamegraph::folded_lines_from_flamegraph_json(&json))
-    })
-}
-
-fn stack_fanout_concurrency(peer_count: usize) -> usize {
-    std::env::var("PROBING_STACK_FANOUT_CONCURRENCY")
-        .ok()
-        .and_then(|value| value.trim().parse::<usize>().ok())
-        .filter(|value| *value > 0)
-        .unwrap_or(32)
-        .min(peer_count.max(1))
+fn decode_remote_flamegraph(
+    response: probing_core::core::federation::FanoutHttpResponse,
+) -> anyhow::Result<Vec<String>> {
+    if response.status >= 400 {
+        anyhow::bail!(
+            "HTTP {}: {}",
+            response.status,
+            String::from_utf8_lossy(&response.body)
+        );
+    }
+    let json = String::from_utf8(response.body)?;
+    Ok(crate::features::flamegraph::folded_lines_from_flamegraph_json(&json))
 }
 
 fn stack_fanout_deadline() -> std::time::Duration {
@@ -862,9 +837,11 @@ fn stack_fanout_deadline() -> std::time::Duration {
 ///
 /// Returns `(json_body, partial)` where `partial` is true when some peers failed.
 pub async fn collect_distributed_stack_flamegraph_json(
+    fanout_service: Option<std::sync::Arc<dyn probing_core::core::federation::FanoutService>>,
     cluster: bool,
     mode: &str,
 ) -> (String, bool) {
+    use probing_core::core::federation::{FanoutHttpMethod, FanoutHttpRequest};
     let mode = if mode == "py" { "py" } else { "mixed" };
     use probing_core::core::cluster::{get_nodes, is_node_alive, local_listen_addrs};
     use std::collections::BTreeSet;
@@ -903,67 +880,68 @@ pub async fn collect_distributed_stack_flamegraph_json(
                 true
             })
             .collect();
-        let concurrency = stack_fanout_concurrency(peers.len());
-        let semaphore = std::sync::Arc::new(tokio::sync::Semaphore::new(concurrency));
-        let mut tasks = tokio::task::JoinSet::new();
-        let mut pending: BTreeSet<String> = peers.iter().map(|node| node.addr.clone()).collect();
-
-        for node in peers {
-            let semaphore = semaphore.clone();
-            tasks.spawn(async move {
-                let addr = node.addr.clone();
-                let result = match semaphore.acquire_owned().await {
-                    Ok(_permit) => {
-                        match tokio::task::spawn_blocking(move || {
-                            remote_pprof_folded_lines_fallback(&addr)
-                        })
-                        .await
-                        {
-                            Ok(result) => result,
-                            Err(error) => Err(anyhow::anyhow!("task join failed: {error}")),
+        if let Some(service) = fanout_service {
+            let folded_request = FanoutHttpRequest {
+                method: FanoutHttpMethod::Get,
+                path: "/apis/pprofextension/flamegraph/folded/json".into(),
+                content_type: None,
+                body: Vec::new(),
+                timeout: stack_fanout_deadline(),
+            };
+            let mut fallback = Vec::new();
+            for (node, result) in service.request_many(peers, folded_request).await {
+                match result
+                    .map_err(anyhow::Error::new)
+                    .and_then(decode_remote_folded)
+                {
+                    Ok(lines) => {
+                        if let Some(rank) = node.rank {
+                            seen_ranks.insert(rank);
                         }
+                        line_sets.push((node.rank, lines));
                     }
-                    Err(error) => Err(anyhow::anyhow!("fan-out semaphore closed: {error}")),
-                };
-                (node, result)
-            });
-        }
+                    Err(error) => {
+                        log::debug!(
+                            "distributed stack folded endpoint {} failed, trying JSON: {error:#}",
+                            node.addr
+                        );
+                        fallback.push(node);
+                    }
+                }
+            }
 
-        let timed_out = {
-            let collect = async {
-                while let Some(joined) = tasks.join_next().await {
-                    match joined {
-                        Ok((node, Ok(lines))) => {
-                            pending.remove(&node.addr);
-                            if let Some(rank) = node.rank {
-                                seen_ranks.insert(rank);
-                            }
-                            line_sets.push((node.rank, lines));
-                        }
-                        Ok((node, Err(error))) => {
-                            pending.remove(&node.addr);
-                            log::warn!(
-                                "distributed stack flamegraph fan-out {} failed: {error:#}",
-                                node.addr
-                            );
-                            nodes_failed.push(format!("{}: {error:#}", node.addr));
-                        }
-                        Err(error) => {
-                            log::warn!("distributed stack flamegraph fan-out task failed: {error}");
+            let json_request = FanoutHttpRequest {
+                method: FanoutHttpMethod::Get,
+                path: "/apis/pprofextension/flamegraph/json".into(),
+                content_type: None,
+                body: Vec::new(),
+                timeout: stack_fanout_deadline(),
+            };
+            for (node, result) in service.request_many(fallback, json_request).await {
+                match result
+                    .map_err(anyhow::Error::new)
+                    .and_then(decode_remote_flamegraph)
+                {
+                    Ok(lines) => {
+                        if let Some(rank) = node.rank {
+                            seen_ranks.insert(rank);
                         }
+                        line_sets.push((node.rank, lines));
+                    }
+                    Err(error) => {
+                        log::warn!(
+                            "distributed stack flamegraph fan-out {} failed: {error:#}",
+                            node.addr
+                        );
+                        nodes_failed.push(format!("{}: {error:#}", node.addr));
                     }
                 }
-            };
-            tokio::time::timeout(stack_fanout_deadline(), collect)
-                .await
-                .is_err()
-        };
-        if timed_out {
-            tasks.abort_all();
+            }
+        } else {
             nodes_failed.extend(
-                pending
+                peers
                     .into_iter()
-                    .map(|addr| format!("{addr}: stack fan-out deadline exceeded")),
+                    .map(|node| format!("{}: fan-out service is not configured", node.addr)),
             );
         }
     }
@@ -1209,24 +1187,15 @@ mod tests {
     }
 
     #[test]
-    fn stack_fanout_limits_are_bounded_and_configurable() {
+    fn stack_fanout_deadline_is_configurable() {
         let _guard = FANOUT_ENV_TEST_LOCK
             .lock()
             .unwrap_or_else(|error| error.into_inner());
-        let previous_concurrency = std::env::var("PROBING_STACK_FANOUT_CONCURRENCY").ok();
         let previous_deadline = std::env::var("PROBING_STACK_FANOUT_DEADLINE_SEC").ok();
 
-        std::env::set_var("PROBING_STACK_FANOUT_CONCURRENCY", "8");
         std::env::set_var("PROBING_STACK_FANOUT_DEADLINE_SEC", "7");
-        assert_eq!(stack_fanout_concurrency(64), 8);
-        assert_eq!(stack_fanout_concurrency(3), 3);
         assert_eq!(stack_fanout_deadline(), Duration::from_secs(7));
 
-        if let Some(value) = previous_concurrency {
-            std::env::set_var("PROBING_STACK_FANOUT_CONCURRENCY", value);
-        } else {
-            std::env::remove_var("PROBING_STACK_FANOUT_CONCURRENCY");
-        }
         if let Some(value) = previous_deadline {
             std::env::set_var("PROBING_STACK_FANOUT_DEADLINE_SEC", value);
         } else {
diff --git a/probing/extensions/python/src/features/torch/mod.rs b/probing/extensions/python/src/features/torch/mod.rs
index 3a26021a..bddab53f 100644
--- a/probing/extensions/python/src/features/torch/mod.rs
+++ b/probing/extensions/python/src/features/torch/mod.rs
@@ -325,11 +325,13 @@ fn query_profiling_impl(query: &str) -> Result<probing_proto::types::DataFrame>
     let query = query.to_owned();
     block_on(async move {
         let engine = probing_core::ENGINE.read().await;
-        let result = engine
-            .async_query(&query)
+        let outcome = engine
+            .query_outcome(&query)
             .await
             .context("Torch query failed")?;
-        result.ok_or_else(|| anyhow::anyhow!("engine returned no dataframe for torch query"))
+        outcome
+            .data
+            .ok_or_else(|| anyhow::anyhow!("engine returned no dataframe for torch query"))
     })
     .map_err(anyhow::Error::new)?
 }
@@ -357,7 +359,8 @@ fn run_torch_query(query: &str) -> Result<probing_proto::types::DataFrame> {
             .enable_all()
             .build()
             .context("failed to build tokio runtime")?;
-        rt.block_on(async { engine.async_query(&query).await })?
+        rt.block_on(async { engine.query_outcome(&query).await })?
+            .data
             .ok_or_else(|| anyhow::anyhow!("minimal engine returned no dataframe for torch query"))
     })
     .join()
@@ -963,18 +966,16 @@ pub async fn collect_distributed_flamegraph_json(
         "python.torch_trace"
     };
     let sql = distributed_torch_trace_sql(table, step);
-    probing_core::core::federation::reset_fanout_stats();
     let engine = probing_core::ENGINE.read().await;
-    let query_result = engine.async_query(&sql).await;
-    let stats = probing_core::core::federation::take_fanout_stats();
-    let dataframe = query_result?.ok_or_else(|| {
+    let outcome = engine.query_outcome(&sql).await?;
+    let dataframe = outcome.data.ok_or_else(|| {
         probing_core::core::EngineError::internal(
             "engine returned no dataframe for distributed torch query",
         )
     })?;
     Ok((
         distributed_flamegraph_json_from_df(&dataframe, metric),
-        probing_core::core::federation::fanout_stats_partial(&stats),
+        outcome.quality.is_partial(),
     ))
 }
 
diff --git a/probing/macros/src/lib.rs b/probing/macros/src/lib.rs
index 0cd521a4..9498dcc0 100644
--- a/probing/macros/src/lib.rs
+++ b/probing/macros/src/lib.rs
@@ -99,6 +99,24 @@ fn impl_probe_extension(ast: &DeriveInput) -> TokenStream {
         }
     });
 
+    let config_specs = field_metadata.iter().map(|meta| {
+        let field_name = meta.name.to_string();
+        let aliases = &meta.aliases;
+        let desc = format!(
+            "{}.\nENV[PROBING_{}_{}]",
+            meta.description,
+            namespace.to_uppercase(),
+            field_name.to_uppercase().replace(".", "_")
+        );
+        quote! {
+            ExtensionConfigSpec {
+                key: #field_name,
+                aliases: &[#(#aliases),*],
+                help: #desc,
+            }
+        }
+    });
+
     // Generate option name constants for consistent usage
     let option_constants = field_metadata.iter().map(|meta| {
         let const_name = format_ident!("OPTION_{}", meta.field.to_uppercase());
@@ -114,7 +132,9 @@ fn impl_probe_extension(ast: &DeriveInput) -> TokenStream {
             fn name(&self) -> String {
                 #http_name.to_string()
             }
+        }
 
+        impl ProbeExtensionConfig for #name {
             fn get(&self, key: &str) -> Result<String, EngineError> {
                 match key {
                     #(#get_matches,)*
@@ -135,6 +155,12 @@ fn impl_probe_extension(ast: &DeriveInput) -> TokenStream {
                 ]
             }
 
+            fn config_specs(&self) -> &'static [ExtensionConfigSpec] {
+                &[
+                    #(#config_specs,)*
+                ]
+            }
+
             // fn datasrc(&self, namespace: &str, name: Option<&str>) -> Option<std::sync::Arc<dyn probing_core::core::ProbeDataSource + Sync + Send>> {
             //     self.plugin(namespace, name)
             // }
diff --git a/probing/macros/tests/test_macros.rs b/probing/macros/tests/test_macros.rs
index c699c427..8de3715a 100644
--- a/probing/macros/tests/test_macros.rs
+++ b/probing/macros/tests/test_macros.rs
@@ -6,6 +6,7 @@ use probing_core::core::EngineError;
 use probing_core::core::ProbeExtension;
 use probing_core::core::ProbeExtensionCall;
 use probing_core::core::ProbeExtensionOption;
+use probing_core::core::{ExtensionConfigSpec, ProbeExtensionConfig};
 
 #[derive(Debug)]
 enum Maybe<T> {
@@ -130,4 +131,10 @@ fn test_macro() {
     assert_eq!(opts[2].key, "test.managed_field_name3");
     assert_eq!(opts[2].value, Some("B".to_string()));
     // assert_eq!(opts[2].help, "describe managed_field_name3");
+
+    let specs = ext.config_specs();
+    assert_eq!(specs.len(), 3);
+    assert_eq!(specs[0].key, "managed_field_name1");
+    assert_eq!(specs[0].aliases, &["mfn1", "a"]);
+    assert_eq!(specs[1].key, "managed.field_name2");
 }
diff --git a/probing/proto/src/lib.rs b/probing/proto/src/lib.rs
index c32b6e88..d810638f 100644
--- a/probing/proto/src/lib.rs
+++ b/probing/proto/src/lib.rs
@@ -9,6 +9,7 @@ pub mod prelude {
     };
     pub use crate::protocol::http::{ApiErrorResponse, ApiProblem};
     pub use crate::protocol::message::Message;
+    pub use crate::protocol::outcome::{MessageMeta, QueryOutcome, QueryQuality};
     pub use crate::protocol::process::{CallFrame, Process};
 
     pub use crate::protocol::query::{Data as QueryDataFormat, Options as QueryOptions, Query};
diff --git a/probing/proto/src/protocol/message.rs b/probing/proto/src/protocol/message.rs
index c7fc9046..6fc9bfa5 100644
--- a/probing/proto/src/protocol/message.rs
+++ b/probing/proto/src/protocol/message.rs
@@ -1,3 +1,4 @@
+use super::outcome::MessageMeta;
 use super::version::ProtocolVersion;
 use serde::{Deserialize, Serialize};
 
@@ -20,7 +21,7 @@ pub struct Message<T> {
 
     /// Optional response metadata (e.g. federated fan-out quality on `/query`).
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub meta: Option<serde_json::Value>,
+    pub meta: Option<MessageMeta>,
 }
 
 impl<T> Message<T> {
diff --git a/probing/proto/src/protocol/mod.rs b/probing/proto/src/protocol/mod.rs
index dc5ffb47..571655db 100644
--- a/probing/proto/src/protocol/mod.rs
+++ b/probing/proto/src/protocol/mod.rs
@@ -1,6 +1,7 @@
 pub mod cluster;
 pub mod http;
 pub mod message;
+pub mod outcome;
 pub mod process;
 pub mod query;
 pub mod training;
diff --git a/probing/proto/src/protocol/outcome.rs b/probing/proto/src/protocol/outcome.rs
new file mode 100644
index 00000000..dbcaecbd
--- /dev/null
+++ b/probing/proto/src/protocol/outcome.rs
@@ -0,0 +1,106 @@
+use serde::{Deserialize, Serialize};
+
+/// Completeness of a query or distributed diagnostic result.
+///
+/// This is part of the result contract: callers must not infer completeness
+/// from HTTP status codes, logs, or request-local side channels.
+#[derive(Debug, Default, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct QueryQuality {
+    #[serde(default)]
+    pub nodes_succeeded: usize,
+    #[serde(default)]
+    pub nodes_failed: Vec<String>,
+    #[serde(default)]
+    pub peer_batches_dropped: usize,
+    #[serde(default)]
+    pub partial: bool,
+}
+
+impl QueryQuality {
+    pub fn complete_node() -> Self {
+        Self {
+            nodes_succeeded: 1,
+            ..Self::default()
+        }
+    }
+
+    pub fn is_partial(&self) -> bool {
+        self.partial || !self.nodes_failed.is_empty() || self.peer_batches_dropped > 0
+    }
+
+    pub fn absorb(&mut self, child: Self) {
+        self.nodes_succeeded += child.nodes_succeeded;
+        self.nodes_failed.extend(child.nodes_failed);
+        self.peer_batches_dropped += child.peer_batches_dropped;
+        self.partial |= child.partial;
+    }
+}
+
+/// A value and the quality/completeness of the evidence used to produce it.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct QueryOutcome<T> {
+    pub data: T,
+    #[serde(default)]
+    pub quality: QueryQuality,
+}
+
+impl<T> QueryOutcome<T> {
+    pub fn complete(data: T) -> Self {
+        Self {
+            data,
+            quality: QueryQuality::default(),
+        }
+    }
+
+    pub fn with_quality(data: T, quality: QueryQuality) -> Self {
+        Self { data, quality }
+    }
+
+    pub fn map<U>(self, map: impl FnOnce(T) -> U) -> QueryOutcome<U> {
+        QueryOutcome {
+            data: map(self.data),
+            quality: self.quality,
+        }
+    }
+}
+
+/// Typed metadata carried by the common wire envelope.
+#[derive(Debug, Default, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct MessageMeta {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub fanout: Option<QueryQuality>,
+}
+
+impl MessageMeta {
+    pub fn from_quality(quality: QueryQuality) -> Option<Self> {
+        (quality != QueryQuality::default()).then_some(Self {
+            fanout: Some(quality),
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn quality_is_partial_for_every_incomplete_signal() {
+        assert!(!QueryQuality::default().is_partial());
+        assert!(QueryQuality {
+            nodes_failed: vec!["rank-1".into()],
+            ..QueryQuality::default()
+        }
+        .is_partial());
+        assert!(QueryQuality {
+            peer_batches_dropped: 1,
+            ..QueryQuality::default()
+        }
+        .is_partial());
+    }
+
+    #[test]
+    fn message_meta_omits_complete_quality() {
+        assert!(MessageMeta::from_quality(QueryQuality::default()).is_none());
+        assert!(MessageMeta::from_quality(QueryQuality::complete_node()).is_some());
+    }
+}
diff --git a/probing/server/API.md b/probing/server/API.md
index 0cb633a6..9cfa6bdc 100644
--- a/probing/server/API.md
+++ b/probing/server/API.md
@@ -10,10 +10,12 @@ in [AUTH.md](AUTH.md).
 | Layer | URL pattern | Registration |
 |-------|-------------|--------------|
 | **Server public** | `/apis/{resource}` | `server/api/mod.rs` (explicit Axum routes) |
-| **Extension** | `/apis/{ext.name()}/{local_path}` | `@ext_handler` (Python) or `ProbeExtensionCall` (Rust) |
+| **Extension** | `/apis/{ext.name()}/{local_path}` | `ProbeExtensionCall::routes` typed registration + `call` execution |
 | **SQL** | `POST /query` | DataFusion engine (not REST) |
 
 Extension HTTP name comes from `ProbeExtension::name()` (derived: struct lowercased, with `probeextension` → `extension`, e.g. `RdmaProbeExtension` → `rdmaextension`, `PythonExt` → `pythonext`).
+Route registration fails engine initialization on duplicate/invalid paths; method,
+content type, CORS, and engine-readiness requirements are part of `ExtensionRoute`.
 
 SQL catalog registration uses [`EngineBuilder::with_data_source`](super::engine::EngineBuilder::with_data_source) and is separate from extension HTTP/SET wiring.
 
@@ -120,6 +122,10 @@ Rust-backed endpoints (`callstack`, `eval`) are thin `@ext_handler` wrappers aro
 |--------|------|---------|
 | POST | `/query` | SQL (`Message<Query>` JSON) |
 | POST | `/query/dto` | SQL (JSON DTO, external clients) |
+
+Core SQL execution returns `QueryOutcome<DataFrame>` (`data` + `quality`). The
+common `/query` envelope serializes non-default quality as typed
+`meta.fanout` (`nodes_succeeded`, `nodes_failed`, `peer_batches_dropped`, `partial`).
 | GET | `/config/{config_key}` | Read config value |
 | GET | `/ws` | WebSocket REPL |
 | * | `/mcp` | MCP Streamable HTTP (agent tools + schema resources) |
@@ -218,7 +224,7 @@ envelope and these documented endpoint-specific formats.
 | Invalid `/query` JSON body | 400 |
 | SQL/config execution failure on `/query` | 500 (`QueryDataFormat::Error` payload preserved) |
 | `/query/dto` engine errors | Same HTTP status as underlying `ApiError` (e.g. 404, 503); DTO `code` mirrors status (`BAD_REQUEST`, `NOT_FOUND`, `SERVICE_UNAVAILABLE`, …) |
-| Partial cluster fan-out (`meta.partial` / `nodes_failed` non-empty) on `/query`, `/query/dto`, `POST /apis/cluster/query`, `GET /apis/training/step_matrix`, or a distributed Torch/pprof flamegraph | 503 (body still returned so clients can inspect partial data) |
+| Partial cluster fan-out (`meta.fanout.partial` / `nodes_failed` non-empty) on `/query`, `/query/dto`, `POST /apis/cluster/query`, `GET /apis/training/step_matrix`, or a distributed Torch/pprof flamegraph | 503 (body still returned so clients can inspect partial data) |
 | Invalid extension query parameter (`cluster`, `step`, `metric`, or `mode`) | 400 |
 | Invalid file path / missing param | 400 |
 | File too large | 413 |
@@ -226,15 +232,9 @@ envelope and these documented endpoint-specific formats.
 ## Extension response headers
 
 Extension fallback responses (`server/api/extension.rs`) take `Content-Type` and CORS
-from [`tests/regression/spec/api_spec.json`](../../tests/regression/spec/api_spec.json), not path substring
-heuristics. Each handler declares:
-
-```json
-"response": { "content_type": "application/json", "cors": true }
-```
-
-Defaults live in `extension_response_defaults`. Lookup is implemented in
-`server/api/response.rs` (compile-time embedded spec).
+from the registered typed `ExtensionRoute`, not path substring heuristics or a
+test artifact embedded in production. Regression tests compare those registered
+contracts with [`api_spec.json`](../../tests/regression/spec/api_spec.json).
 
 | Field | Meaning |
 |-------|---------|
diff --git a/probing/server/src/cluster_http.rs b/probing/server/src/cluster_http.rs
index e0184a56..7a7d7ef3 100644
--- a/probing/server/src/cluster_http.rs
+++ b/probing/server/src/cluster_http.rs
@@ -1,15 +1,14 @@
 use std::time::Duration;
 
 use anyhow::Result;
+use probing_core::core::federation::{FanoutHttpMethod, FanoutHttpRequest};
 use probing_proto::prelude::{Node, NodeListResponse, NodeReportRequest, NodeReportResponse};
 
-use crate::auth::peer_auth_header_value;
-
-fn authenticate_peer_request<B>(request: ureq::RequestBuilder<B>) -> ureq::RequestBuilder<B> {
-    match peer_auth_header_value() {
-        Some(value) => request.header("Authorization", value),
-        None => request,
-    }
+fn peer_addr(http_base: &str) -> &str {
+    http_base
+        .trim_end_matches('/')
+        .trim_start_matches("http://")
+        .trim_start_matches("https://")
 }
 
 pub fn get_i32_env(name: &str) -> Option<i32> {
@@ -28,22 +27,29 @@ fn nodes_page_size() -> usize {
 }
 
 pub fn fetch_nodes_blocking(http_base: &str) -> Result<Vec<Node>> {
-    let base = http_base.trim_end_matches('/');
+    let addr = peer_addr(http_base);
     let page_size = nodes_page_size();
     let mut offset = 0usize;
     let mut all = Vec::new();
     loop {
-        let url = format!("{base}/apis/nodes?offset={offset}&limit={page_size}");
-        let request = ureq::get(&url)
-            .config()
-            .no_delay(true)
-            .timeout_global(Some(Duration::from_secs(10)))
-            .build();
-        let text = authenticate_peer_request(request)
-            .call()?
-            .body_mut()
-            .read_to_string()?;
-        let resp: NodeListResponse = serde_json::from_str(&text)?;
+        let response = crate::server::cluster_fanout::request_peer_blocking(
+            addr,
+            FanoutHttpRequest {
+                method: FanoutHttpMethod::Get,
+                path: format!("/apis/nodes?offset={offset}&limit={page_size}"),
+                content_type: None,
+                body: Vec::new(),
+                timeout: Duration::from_secs(10),
+            },
+        )?;
+        if response.status >= 400 {
+            anyhow::bail!(
+                "HTTP {}: {}",
+                response.status,
+                String::from_utf8_lossy(&response.body)
+            );
+        }
+        let resp: NodeListResponse = serde_json::from_slice(&response.body)?;
         let empty = resp.nodes.is_empty();
         all.extend(resp.nodes);
         if all.len() >= resp.total || empty {
@@ -59,24 +65,56 @@ pub fn put_nodes_blocking(
     nodes: Vec<Node>,
     seen_version: u64,
 ) -> Result<NodeReportResponse> {
-    let url = format!("{}/apis/nodes", http_base.trim_end_matches('/'));
-    let body = NodeReportRequest {
-        nodes,
-        seen_version,
-    };
-    let request = ureq::put(&url)
-        .config()
-        .no_delay(true)
-        .timeout_global(Some(Duration::from_secs(
+    let addr = peer_addr(http_base);
+    let response = crate::server::cluster_fanout::request_peer_blocking(
+        addr,
+        node_report_request(nodes, seen_version)?,
+    )?;
+    decode_node_report(response)
+}
+
+pub async fn put_nodes(
+    http_base: &str,
+    nodes: Vec<Node>,
+    seen_version: u64,
+) -> Result<NodeReportResponse> {
+    let response = crate::server::cluster_fanout::core_service()?
+        .request_peer(
+            peer_addr(http_base),
+            node_report_request(nodes, seen_version)?,
+        )
+        .await
+        .map_err(anyhow::Error::new)?;
+    decode_node_report(response)
+}
+
+fn node_report_request(nodes: Vec<Node>, seen_version: u64) -> Result<FanoutHttpRequest> {
+    Ok(FanoutHttpRequest {
+        method: FanoutHttpMethod::Put,
+        path: "/apis/nodes".into(),
+        content_type: Some("application/json".into()),
+        body: serde_json::to_vec(&NodeReportRequest {
+            nodes,
+            seen_version,
+        })?,
+        timeout: Duration::from_secs(
             std::env::var("PROBING_CLUSTER_REPORT_TIMEOUT_SEC")
                 .ok()
                 .and_then(|v| v.parse().ok())
                 .unwrap_or(5),
-        )))
-        .build();
-    let text = authenticate_peer_request(request)
-        .send_json(body)?
-        .body_mut()
-        .read_to_string()?;
-    Ok(serde_json::from_str(&text)?)
+        ),
+    })
+}
+
+fn decode_node_report(
+    response: probing_core::core::federation::FanoutHttpResponse,
+) -> Result<NodeReportResponse> {
+    if response.status >= 400 {
+        anyhow::bail!(
+            "HTTP {}: {}",
+            response.status,
+            String::from_utf8_lossy(&response.body)
+        );
+    }
+    Ok(serde_json::from_slice(&response.body)?)
 }
diff --git a/probing/server/src/engine.rs b/probing/server/src/engine.rs
index c1d1685a..15026495 100644
--- a/probing/server/src/engine.rs
+++ b/probing/server/src/engine.rs
@@ -16,10 +16,7 @@ use probing_core::config;
 
 use crate::server::error::{ApiError, ApiResult};
 
-use probing_core::core::federation::{
-    fanout_stats_partial, reset_fanout_stats, take_fanout_stats, with_fanout_scope_async,
-    FanoutScope,
-};
+use probing_core::core::federation::{with_fanout_scope_async, FanoutScope};
 use probing_core::core::UnifiedMemtableProbeDataSource;
 pub use probing_core::ENGINE;
 use probing_python::extensions::python::PythonProbeDataSource;
@@ -29,12 +26,13 @@ use probing_python::extensions::python::PythonProbeDataSource;
 pub async fn initialize_engine() -> Result<()> {
     probing_hccl_shim::register_docs();
     probing_nccl_profiler::register_docs();
+    let fanout_service = crate::server::cluster_fanout::core_service()?;
     let builder = probing_core::create_engine()
-        .with_peer_query_transport(crate::server::cluster_fanout::core_transport())
+        .with_fanout_service(fanout_service.clone())
         .with_data_source(cc::ClusterProbeDataSource::create("cluster", "nodes"))
         .with_data_source(cc::EnvProbeDataSource::create("process", "envs"))
         .with_data_source(cc::FilesProbeDataSource::create("files"))
-        .with_extension(py::PprofProbeExtension::default())
+        .with_extension(py::PprofProbeExtension::with_fanout_service(fanout_service))
         .with_extension(py::TorchProbeExtension::default())
         .with_extension(se::ServerProbeExtension::default())
         .with_extension(py::PythonExt::default())
@@ -127,7 +125,7 @@ async fn execute_set_via_config(key: &str, value: &str) -> Result<()> {
     Ok(())
 }
 
-pub async fn handle_query(request: Query) -> Result<QueryDataFormat> {
+pub async fn handle_query(request: Query) -> Result<QueryOutcome<QueryDataFormat>> {
     if let Some(msg) = crate::engine_lifecycle::engine_not_ready_message() {
         return Err(anyhow::anyhow!(msg));
     }
@@ -143,15 +141,16 @@ pub async fn handle_query(request: Query) -> Result<QueryDataFormat> {
                 .with_context(|| format!("Failed SET for config key '{key}'"))?;
             log::debug!("Successfully executed SET for config key: {key}");
         }
-        return Ok(QueryDataFormat::Nil);
+        return Ok(QueryOutcome::complete(QueryDataFormat::Nil));
     }
 
-    reset_fanout_stats();
     let engine = ENGINE.read().await;
     log::debug!("Executing SELECT query: {expr}");
-    match engine.async_query(&expr).await {
-        Ok(Some(dataframe)) => Ok(QueryDataFormat::DataFrame(dataframe)),
-        Ok(None) => Ok(QueryDataFormat::Nil),
+    match engine.query_outcome(&expr).await {
+        Ok(outcome) => Ok(outcome.map(|data| match data {
+            Some(dataframe) => QueryDataFormat::DataFrame(dataframe),
+            None => QueryDataFormat::Nil,
+        })),
         Err(e) => {
             if is_missing_table_error(&e) {
                 log::debug!("Optional table missing for SELECT '{expr}': {e}");
@@ -171,22 +170,12 @@ fn is_missing_table_error(err: &impl std::fmt::Display) -> bool {
 
 fn fanout_meta_from_stats(
     stats: probing_core::core::federation::FanoutStats,
-) -> Option<serde_json::Value> {
-    if !fanout_stats_partial(&stats) {
-        return None;
-    }
-    Some(serde_json::json!({
-        "fanout": {
-            "partial": true,
-            "nodes_succeeded": stats.nodes_succeeded,
-            "nodes_failed": stats.nodes_failed,
-            "peer_batches_dropped": stats.peer_batches_dropped,
-        }
-    }))
+) -> Option<MessageMeta> {
+    MessageMeta::from_quality(stats)
 }
 
 fn query_response_partial(stats: &probing_core::core::federation::FanoutStats) -> bool {
-    fanout_stats_partial(stats)
+    stats.is_partial()
 }
 
 /// Serialized `/query` body plus whether federated fan-out was partial.
@@ -214,22 +203,22 @@ async fn query_in_fanout_context(req: String) -> ApiResult<QueryHttpEnvelope> {
     };
 
     // Await the async handle_query function
-    let reply_payload = match handle_query(request).await {
+    let reply_outcome = match handle_query(request).await {
         Ok(reply) => reply,
         Err(err) => {
             // Error already logged in handle_query if it originated there
-            QueryDataFormat::Error(QueryError {
+            QueryOutcome::complete(QueryDataFormat::Error(QueryError {
                 code: ErrorCode::Internal,
                 message: format!("{err:#}"),
                 details: None,
-            })
+            }))
         }
     };
 
-    let error = matches!(&reply_payload, QueryDataFormat::Error(_));
+    let error = matches!(&reply_outcome.data, QueryDataFormat::Error(_));
 
     // Wrap the payload in a Message
-    let stats = take_fanout_stats();
+    let stats = reply_outcome.quality;
     let partial = query_response_partial(&stats);
     if partial {
         log::warn!(
@@ -239,7 +228,7 @@ async fn query_in_fanout_context(req: String) -> ApiResult<QueryHttpEnvelope> {
             stats.peer_batches_dropped,
         );
     }
-    let mut reply_message = Message::new(reply_payload);
+    let mut reply_message = Message::new(reply_outcome.data);
     reply_message.meta = fanout_meta_from_stats(stats);
 
     // Serialize the response message
@@ -268,6 +257,6 @@ mod tests {
 
         assert!(query_response_partial(&stats));
         let meta = fanout_meta_from_stats(stats).expect("partial response metadata");
-        assert_eq!(meta["fanout"]["partial"], true);
+        assert!(meta.fanout.expect("fanout quality").partial);
     }
 }
diff --git a/probing/server/src/extensions.rs b/probing/server/src/extensions.rs
index 4fa0f926..6f394d43 100644
--- a/probing/server/src/extensions.rs
+++ b/probing/server/src/extensions.rs
@@ -1,5 +1,6 @@
 use probing_core::core::{
-    EngineError, Maybe, ProbeExtension, ProbeExtensionCall, ProbeExtensionOption,
+    EngineError, ExtensionConfigSpec, Maybe, ProbeExtension, ProbeExtensionCall,
+    ProbeExtensionConfig, ProbeExtensionOption,
 };
 
 use crate::{start_remote, start_report_worker};
@@ -171,7 +172,7 @@ impl ServerProbeExtension {
 
 #[cfg(test)]
 mod test {
-    use probing_core::core::ProbeExtension;
+    use probing_core::core::ProbeExtensionConfig;
 
     use crate::extensions::ServerProbeExtension;
 
diff --git a/probing/server/src/mcp/helpers.rs b/probing/server/src/mcp/helpers.rs
index b0f3e9ec..2e4a8d1d 100644
--- a/probing/server/src/mcp/helpers.rs
+++ b/probing/server/src/mcp/helpers.rs
@@ -2,9 +2,7 @@
 
 use std::collections::HashMap;
 
-use probing_core::core::federation::{
-    fanout_strict_enabled, take_fanout_stats, with_fanout_scope_async, FanoutScope,
-};
+use probing_core::core::federation::{fanout_strict_enabled, with_fanout_scope_async, FanoutScope};
 use probing_core::core::ProbeExtensionManager;
 use probing_proto::prelude::{Ele, Query, QueryDataFormat};
 use rmcp::ErrorData;
@@ -102,23 +100,25 @@ pub(crate) async fn extension_request(path: &str, body: &[u8]) -> Result<Vec<u8>
 pub async fn engine_query_json(sql: String, limit: usize) -> Result<serde_json::Value, ErrorData> {
     crate::server::sql_guard::ensure_read_only_sql(&sql).map_err(tool_error)?;
     with_fanout_scope_async(FanoutScope::Auto, async move {
-        let reply = handle_query(Query {
+        let outcome = handle_query(Query {
             expr: sql,
             opts: None,
         })
         .await
         .map_err(tool_error_from)?;
-        let mut payload = dataframe_reply_to_json(reply, limit)?;
-        attach_fanout_quality(&mut payload)?;
+        let mut payload = dataframe_reply_to_json(outcome.data, limit)?;
+        attach_fanout_quality(&mut payload, outcome.quality)?;
         Ok(payload)
     })
     .await
 }
 
 /// Surface federated / global-table fan-out completeness when peers were dropped.
-fn attach_fanout_quality(payload: &mut serde_json::Value) -> Result<(), ErrorData> {
-    let stats = take_fanout_stats();
-    if !probing_core::core::federation::fanout_stats_partial(&stats) {
+fn attach_fanout_quality(
+    payload: &mut serde_json::Value,
+    stats: probing_proto::prelude::QueryQuality,
+) -> Result<(), ErrorData> {
+    if !stats.is_partial() {
         return Ok(());
     }
     if fanout_strict_enabled() {
diff --git a/probing/server/src/mcp/mod.rs b/probing/server/src/mcp/mod.rs
index 94220277..605676a3 100644
--- a/probing/server/src/mcp/mod.rs
+++ b/probing/server/src/mcp/mod.rs
@@ -386,7 +386,7 @@ impl ServerHandler for ProbingMcp {
         })
         .await
         .map_err(tool_error_from)?;
-        let QueryDataFormat::DataFrame(df) = reply else {
+        let QueryDataFormat::DataFrame(df) = reply.data else {
             return Ok(ListResourcesResult {
                 resources: vec![catalog_resource()],
                 meta: None,
diff --git a/probing/server/src/mcp/skill_backend.rs b/probing/server/src/mcp/skill_backend.rs
index 4cd4912f..7e9242d5 100644
--- a/probing/server/src/mcp/skill_backend.rs
+++ b/probing/server/src/mcp/skill_backend.rs
@@ -22,7 +22,7 @@ impl SkillBackend for ServerBackend {
         })
         .await
         .map_err(|e| SkillRunError(e.to_string()))?;
-        match reply {
+        match reply.data {
             QueryDataFormat::DataFrame(df) => Ok(df),
             QueryDataFormat::Nil => Ok(DataFrame::default()),
             QueryDataFormat::Error(err) => {
diff --git a/probing/server/src/report.rs b/probing/server/src/report.rs
index dcdd6484..b878f39f 100644
--- a/probing/server/src/report.rs
+++ b/probing/server/src/report.rs
@@ -1,7 +1,7 @@
-use anyhow::{Context, Result};
+use anyhow::Result;
 
 use super::vars::read_probing_address;
-use crate::cluster_http::{get_i32_env, put_nodes_blocking};
+use crate::cluster_http::{get_i32_env, put_nodes};
 use crate::cluster_report_backoff::{classify_report_outcome, ReportBackoff, ReportOutcome};
 use probing_proto::prelude::{Node, NodeReportResponse};
 
@@ -123,15 +123,8 @@ pub(crate) fn build_local_node(local_addr: &str) -> Node {
 }
 
 async fn request_remote(url: &str, nodes: Vec<Node>) -> Result<NodeReportResponse> {
-    let url = url.to_string();
-    tokio::task::spawn_blocking(move || request_remote_blocking(&url, nodes))
-        .await
-        .context("cluster report spawn_blocking failed")?
-}
-
-fn request_remote_blocking(url: &str, nodes: Vec<Node>) -> Result<NodeReportResponse> {
     let base = url.strip_suffix("/apis/nodes").unwrap_or(url);
-    put_nodes_blocking(base, nodes, probing_core::core::cluster::cluster_version())
+    put_nodes(base, nodes, probing_core::core::cluster::cluster_version()).await
 }
 
 #[cfg(test)]
diff --git a/probing/server/src/server/api/extension.rs b/probing/server/src/server/api/extension.rs
index 7653ee49..73b0c92d 100644
--- a/probing/server/src/server/api/extension.rs
+++ b/probing/server/src/server/api/extension.rs
@@ -6,7 +6,7 @@ use axum::{
 };
 use http_body_util::BodyExt;
 
-use probing_core::core::{ProbeExtensionManager, ProbeExtensionResponse};
+use probing_core::core::{ExtensionRoute, ProbeExtensionManager, ProbeExtensionResponse};
 
 use crate::engine::ENGINE;
 use crate::server::api::response;
@@ -23,33 +23,6 @@ pub async fn handle(req: axum::extract::Request) -> ApiResult<Response> {
         return Ok(cors_preflight().into_response());
     }
 
-    if let Some(route) = response::route_spec(path) {
-        if route.method != method.as_str() {
-            return Err(ApiError::method_not_allowed(format!(
-                "Method {method} not allowed for {path}; expected {}",
-                route.method
-            )));
-        }
-        if route.requires_engine_ready {
-            if let Some(message) = crate::engine_lifecycle::engine_not_ready_message() {
-                return Err(ApiError::service_unavailable(message));
-            }
-        }
-    }
-
-    let params: HashMap<String, String> = match parts.uri.query() {
-        Some(q) => serde_urlencoded::from_str(q)
-            .map_err(|e| ApiError::bad_request(format!("Invalid query string: {e}")))?,
-        None => HashMap::new(),
-    };
-
-    let body_bytes = body.collect().await?.to_bytes();
-
-    log::debug!(
-        "Extension API [{method} {path}]: params = {params:?}, body_size = {} bytes",
-        body_bytes.len()
-    );
-
     let eem = {
         let engine = ENGINE.read().await;
         engine
@@ -66,8 +39,38 @@ pub async fn handle(req: axum::extract::Request) -> ApiResult<Response> {
         return Ok((StatusCode::NOT_FOUND, "Extension manager not available").into_response());
     };
 
+    let Some(route) = eem.route(path).await else {
+        return Err(ApiError::not_found(format!(
+            "No extension route registered for {path}"
+        )));
+    };
+    if route.method.as_str() != method.as_str() {
+        return Err(ApiError::method_not_allowed(format!(
+            "Method {method} not allowed for {path}; expected {}",
+            route.method.as_str()
+        )));
+    }
+    if route.requires_engine_ready {
+        if let Some(message) = crate::engine_lifecycle::engine_not_ready_message() {
+            return Err(ApiError::service_unavailable(message));
+        }
+    }
+
+    let params: HashMap<String, String> = match parts.uri.query() {
+        Some(q) => serde_urlencoded::from_str(q)
+            .map_err(|e| ApiError::bad_request(format!("Invalid query string: {e}")))?,
+        None => HashMap::new(),
+    };
+
+    let body_bytes = body.collect().await?.to_bytes();
+
+    log::debug!(
+        "Extension API [{method} {path}]: params = {params:?}, body_size = {} bytes",
+        body_bytes.len()
+    );
+
     match eem.call_response(path, &params, &body_bytes).await {
-        Ok(extension) => Ok(extension_response(path, extension).into_response()),
+        Ok(extension) => Ok(extension_response(route, extension).into_response()),
         Err(e) => {
             log::error!("Extension call failed for path '{path}': {e}");
             Err(ApiError::from_engine(e))
@@ -81,10 +84,10 @@ pub fn api_path(full_path: &str) -> &str {
 }
 
 fn extension_response(
-    path: &str,
+    route: ExtensionRoute,
     response: ProbeExtensionResponse,
 ) -> (StatusCode, HeaderMap, Vec<u8>) {
-    let meta = response::lookup(path);
+    let meta = response::response_meta(route);
     let status = if response.partial {
         StatusCode::SERVICE_UNAVAILABLE
     } else {
@@ -108,11 +111,12 @@ fn cors_preflight() -> (StatusCode, HeaderMap, &'static str) {
 #[cfg(test)]
 mod tests {
     use super::{api_path, extension_response};
-    use crate::server::api::response::{
-        lookup, route_spec, status_for_extension_body, ResponseMeta,
-    };
+    use crate::server::api::response::status_for_extension_body;
     use axum::http::StatusCode;
-    use probing_core::core::ProbeExtensionResponse;
+    use probing_core::core::{
+        ExtensionContentType, ExtensionHttpMethod, ExtensionRoute, ProbeExtensionCall,
+        ProbeExtensionResponse,
+    };
 
     fn load_spec() -> serde_json::Value {
         let path = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"))
@@ -129,31 +133,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn eval_route_is_post_in_spec() {
-        let route = route_spec("/pythonext/eval").expect("eval route");
-        assert_eq!(route.method, "POST");
-        assert!(!route.requires_engine_ready);
-    }
-
-    #[test]
-    fn distributed_torch_route_requires_ready_engine() {
-        let route = route_spec("/torchextension/flamegraph/distributed/json")
-            .expect("distributed torch route");
-        assert!(route.requires_engine_ready);
-    }
-
-    #[test]
-    fn response_lookup_follows_spec_not_path_heuristics() {
-        assert_eq!(
-            lookup("/pythonext/callstack"),
-            ResponseMeta {
-                content_type: "application/json",
-                cors: false,
-            }
-        );
-    }
-
     #[test]
     fn api_path_matches_pythonext_spec_urls() {
         let spec = load_spec();
@@ -167,6 +146,69 @@ mod tests {
         }
     }
 
+    #[test]
+    fn registered_route_contracts_match_api_spec() {
+        let spec = load_spec();
+        #[allow(unused_mut)]
+        let mut contracts = vec![
+            (
+                "pythonext",
+                probing_python::extensions::PythonExt::default().routes(),
+            ),
+            (
+                "torchextension",
+                probing_python::extensions::TorchProbeExtension::default().routes(),
+            ),
+            (
+                "pprofextension",
+                probing_python::extensions::PprofProbeExtension::default().routes(),
+            ),
+        ];
+        #[cfg(target_os = "linux")]
+        contracts.push((
+            "rdmaextension",
+            probing_cc::extensions::RdmaProbeExtension::default().routes(),
+        ));
+
+        let expected = spec["pythonext_handlers"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|entry| ("pythonext", entry))
+            .chain(
+                spec["other_extensions"]
+                    .as_array()
+                    .unwrap()
+                    .iter()
+                    .filter(|entry| {
+                        cfg!(target_os = "linux") || entry["extension_name"] != "rdmaextension"
+                    })
+                    .map(|entry| (entry["extension_name"].as_str().unwrap(), entry)),
+            );
+
+        for (extension_name, entry) in expected {
+            let local_path = entry["local_path"].as_str().unwrap();
+            let route = contracts
+                .iter()
+                .find(|(name, _)| *name == extension_name)
+                .and_then(|(_, routes)| routes.iter().find(|route| route.path == local_path))
+                .unwrap_or_else(|| panic!("missing typed route {extension_name}/{local_path}"));
+            assert_eq!(route.method.as_str(), entry["method"].as_str().unwrap());
+            assert_eq!(
+                route.content_type.as_str(),
+                entry["response"]["content_type"].as_str().unwrap()
+            );
+            assert_eq!(
+                route.cors,
+                entry["response"]["cors"].as_bool().unwrap_or(false)
+            );
+            assert_eq!(
+                route.requires_engine_ready,
+                entry["requires_engine_ready"].as_bool().unwrap_or(false)
+            );
+        }
+    }
+
     #[test]
     fn handler_errors_map_to_http_status() {
         assert_eq!(
@@ -186,7 +228,15 @@ mod tests {
         };
 
         assert_eq!(
-            extension_response("/torchextension/flamegraph/distributed/json", response).0,
+            extension_response(
+                ExtensionRoute::new(
+                    "flamegraph/distributed/json",
+                    ExtensionHttpMethod::Get,
+                    ExtensionContentType::Json,
+                ),
+                response,
+            )
+            .0,
             StatusCode::SERVICE_UNAVAILABLE
         );
     }
diff --git a/probing/server/src/server/api/response.rs b/probing/server/src/server/api/response.rs
index 370522bf..6356e92d 100644
--- a/probing/server/src/server/api/response.rs
+++ b/probing/server/src/server/api/response.rs
@@ -1,9 +1,7 @@
-//! Extension HTTP routing metadata driven by `tests/regression/spec/api_spec.json`.
-
-use std::collections::HashMap;
+//! HTTP rendering for type-checked extension route contracts.
 
 use axum::http::{HeaderMap, HeaderValue, StatusCode};
-use once_cell::sync::Lazy;
+use probing_core::core::ExtensionRoute;
 
 /// Per-endpoint response metadata from the API spec.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -21,155 +19,13 @@ impl Default for ResponseMeta {
     }
 }
 
-/// Method + response metadata for a spec-defined extension route.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct ExtensionRouteSpec {
-    pub method: &'static str,
-    pub response: ResponseMeta,
-    pub requires_engine_ready: bool,
-}
-
-static ROUTE_MAP: Lazy<HashMap<String, ExtensionRouteSpec>> = Lazy::new(|| {
-    build_route_map().unwrap_or_else(|e| {
-        log::error!("failed to build extension route map: {e}; using empty map");
-        HashMap::new()
-    })
-});
-
-fn build_route_map() -> Result<HashMap<String, ExtensionRouteSpec>, String> {
-    let spec: serde_json::Value = serde_json::from_str(include_str!(
-        "../../../../../tests/regression/spec/api_spec.json"
-    ))
-    .map_err(|e| format!("parse api_spec.json: {e}"))?;
-
-    let defaults = spec
-        .get("extension_response_defaults")
-        .cloned()
-        .unwrap_or_else(|| serde_json::json!({}));
-
-    let mut map = HashMap::new();
-
-    let ext = spec["routing"]["python_http_extension_name"]
-        .as_str()
-        .ok_or("missing python_http_extension_name")?;
-    let handlers = spec["pythonext_handlers"]
-        .as_array()
-        .ok_or("missing pythonext_handlers")?;
-    for handler in handlers {
-        let local = handler["local_path"]
-            .as_str()
-            .ok_or("missing local_path in pythonext_handlers entry")?;
-        let method = handler["method"]
-            .as_str()
-            .ok_or("missing method in pythonext_handlers entry")?;
-        let response = handler.get("response").unwrap_or(&defaults);
-        map.insert(
-            format!("{ext}/{local}"),
-            ExtensionRouteSpec {
-                method: parse_method(method),
-                response: parse_response_meta(response, &defaults),
-                requires_engine_ready: handler
-                    .get("requires_engine_ready")
-                    .and_then(|value| value.as_bool())
-                    .unwrap_or(false),
-            },
-        );
-    }
-
-    let other_extensions = spec["other_extensions"]
-        .as_array()
-        .ok_or("missing other_extensions")?;
-    for entry in other_extensions {
-        let name = entry["extension_name"]
-            .as_str()
-            .ok_or("missing extension_name in other_extensions entry")?;
-        let local = entry["local_path"].as_str().unwrap_or("");
-        let method = entry["method"]
-            .as_str()
-            .ok_or("missing method in other_extensions entry")?;
-        let response = entry.get("response").unwrap_or(&defaults);
-        let key = if local.is_empty() {
-            name.to_string()
-        } else {
-            format!("{name}/{local}")
-        };
-        map.insert(
-            key,
-            ExtensionRouteSpec {
-                method: parse_method(method),
-                response: parse_response_meta(response, &defaults),
-                requires_engine_ready: entry
-                    .get("requires_engine_ready")
-                    .and_then(|value| value.as_bool())
-                    .unwrap_or(false),
-            },
-        );
-    }
-
-    Ok(map)
-}
-
-fn parse_method(method: &str) -> &'static str {
-    match method {
-        "GET" => "GET",
-        "POST" => "POST",
-        "PUT" => "PUT",
-        "DELETE" => "DELETE",
-        other => {
-            log::error!("unsupported HTTP method in api_spec.json: {other}; defaulting to GET");
-            "GET"
-        }
-    }
-}
-
-fn parse_response_meta(response: &serde_json::Value, defaults: &serde_json::Value) -> ResponseMeta {
-    let content_type = response
-        .get("content_type")
-        .or_else(|| defaults.get("content_type"))
-        .and_then(|v| v.as_str())
-        .unwrap_or("text/plain");
-    let cors = response
-        .get("cors")
-        .or_else(|| defaults.get("cors"))
-        .and_then(|v| v.as_bool())
-        .unwrap_or(false);
-
+pub fn response_meta(route: ExtensionRoute) -> ResponseMeta {
     ResponseMeta {
-        content_type: match content_type {
-            "application/json" => "application/json",
-            "text/plain" => "text/plain",
-            "text/html" => "text/html",
-            other => {
-                log::error!(
-                    "unsupported extension response content_type in api_spec.json: {other}; \
-                     defaulting to text/plain"
-                );
-                "text/plain"
-            }
-        },
-        cors,
+        content_type: route.content_type.as_str(),
+        cors: route.cors,
     }
 }
 
-fn route_key(path: &str) -> String {
-    path.trim_start_matches('/')
-        .trim_end_matches('/')
-        .to_string()
-}
-
-/// Look up spec metadata for an extension path (e.g. `/pythonext/trace/list`).
-pub fn route_spec(path: &str) -> Option<&'static ExtensionRouteSpec> {
-    let key = route_key(path);
-    ROUTE_MAP.get(&key)
-}
-
-/// Look up response metadata; unknown paths use defaults.
-pub fn lookup(path: &str) -> ResponseMeta {
-    route_spec(path)
-        .map(|spec| spec.response)
-        .unwrap_or_default()
-}
-
 /// HTTP status for an extension response body (Python router JSON errors → 4xx).
 pub fn status_for_extension_body(content_type: &str, body: &[u8]) -> StatusCode {
     if content_type != "application/json" {
@@ -220,31 +76,23 @@ pub fn append_cors(headers: &mut HeaderMap) {
 #[cfg(test)]
 mod tests {
     use super::*;
-
-    fn load_spec() -> serde_json::Value {
-        let path = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"))
-            .join("../../tests/regression/spec/api_spec.json");
-        let text = std::fs::read_to_string(path).expect("read api_spec.json");
-        serde_json::from_str(&text).expect("parse api_spec.json")
-    }
+    use probing_core::core::{ExtensionContentType, ExtensionHttpMethod};
 
     #[test]
-    fn spec_paths_have_route_entries() {
-        let spec = load_spec();
-        let ext = spec["routing"]["python_http_extension_name"]
-            .as_str()
-            .unwrap();
-
-        for handler in spec["pythonext_handlers"].as_array().unwrap() {
-            let local = handler["local_path"].as_str().unwrap();
-            let path = format!("/{ext}/{local}");
-            let route = route_spec(&path).expect("route spec");
-            assert_eq!(route.method, handler["method"].as_str().unwrap());
-            assert_eq!(
-                route.response.content_type,
-                handler["response"]["content_type"].as_str().unwrap()
-            );
-        }
+    fn response_meta_comes_from_typed_route() {
+        let route = ExtensionRoute::new(
+            "trace/chrome-tracing",
+            ExtensionHttpMethod::Get,
+            ExtensionContentType::Json,
+        )
+        .with_cors();
+        assert_eq!(
+            response_meta(route),
+            ResponseMeta {
+                content_type: "application/json",
+                cors: true,
+            }
+        );
     }
 
     #[test]
@@ -272,11 +120,4 @@ mod tests {
             StatusCode::OK
         );
     }
-
-    #[test]
-    fn lookup_unknown_path_uses_defaults_without_panic() {
-        let meta = lookup("/pythonext/does-not-exist");
-        assert_eq!(meta.content_type, "text/plain");
-        assert!(!meta.cors);
-    }
 }
diff --git a/probing/server/src/server/cluster_fanout.rs b/probing/server/src/server/cluster_fanout.rs
index 3f85dd9e..69c26f6c 100644
--- a/probing/server/src/server/cluster_fanout.rs
+++ b/probing/server/src/server/cluster_fanout.rs
@@ -12,8 +12,7 @@ mod types;
 use probing_core::core::cluster::{local_leaf_peers, node_aggregator_peers};
 use probing_core::core::federation::{
     can_fanout_via_global_catalog, cluster_rank_for_endpoint, is_local0_from_env,
-    reset_fanout_stats, rewrite_sql_for_global_fanout, take_fanout_stats, validate_global_query,
-    with_fanout_scope_async, FanoutScope,
+    rewrite_sql_for_global_fanout, validate_global_query, with_fanout_scope_async, FanoutScope,
 };
 use probing_proto::prelude::*;
 
@@ -24,8 +23,9 @@ use planner::{peers_for_scope, plan_fanout};
 use transport::HttpPeerQueryClient;
 use types::{finish_fanout, FanoutOutcome};
 
-pub(crate) use transport::core_transport;
+pub(crate) use transport::core_service;
 pub use transport::remote_query_df;
+pub(crate) use transport::request_peer_blocking;
 pub use types::{ClusterFanoutScope, FanoutMeta, FanoutQueryResponse};
 
 fn local_host_label() -> String {
@@ -33,23 +33,35 @@ fn local_host_label() -> String {
 }
 
 pub async fn query_local_df(sql: &str) -> anyhow::Result<DataFrame> {
-    match handle_query(Query {
+    Ok(query_local_outcome(sql).await?.data)
+}
+
+async fn query_local_outcome(sql: &str) -> anyhow::Result<QueryOutcome<DataFrame>> {
+    let outcome = handle_query(Query {
         expr: sql.to_string(),
         ..Default::default()
     })
-    .await?
-    {
-        QueryDataFormat::DataFrame(dataframe) => Ok(dataframe),
-        QueryDataFormat::Nil => Ok(DataFrame::default()),
+    .await?;
+    let dataframe = match outcome.data {
+        QueryDataFormat::DataFrame(dataframe) => dataframe,
+        QueryDataFormat::Nil => DataFrame::default(),
         QueryDataFormat::Error(error) => anyhow::bail!("query error: {}", error.message),
         QueryDataFormat::TimeSeries(_) => anyhow::bail!("unexpected timeseries"),
-    }
+    };
+    Ok(QueryOutcome::with_quality(dataframe, outcome.quality))
 }
 
 async fn query_local_df_in_scope(scope: FanoutScope, sql: &str) -> anyhow::Result<DataFrame> {
     with_fanout_scope_async(scope, query_local_df(sql)).await
 }
 
+async fn query_local_outcome_in_scope(
+    scope: FanoutScope,
+    sql: &str,
+) -> anyhow::Result<QueryOutcome<DataFrame>> {
+    with_fanout_scope_async(scope, query_local_outcome(sql)).await
+}
+
 /// Run `sql` locally, optionally fanning out to peer nodes in the cluster view.
 pub async fn fanout_query(
     sql: &str,
@@ -117,7 +129,7 @@ async fn fanout_node_tier(sql: &str, hierarchical: bool) -> anyhow::Result<Fanou
     let leaves = local_leaf_peers();
     let mut meta = FanoutMeta::local(true, hierarchical, ClusterFanoutScope::Node);
     meta.local_ranks_queried = leaves.len();
-    let client = HttpPeerQueryClient;
+    let client = HttpPeerQueryClient::new(core_service()?);
     for (node, result) in query_leaf_peers(&client, leaves, sql).await {
         match result {
             Ok(dataframe) => {
@@ -163,11 +175,11 @@ async fn fanout_flat(sql: &str) -> anyhow::Result<FanoutOutcome> {
 }
 
 async fn fanout_via_global_catalog(sql: &str, scope: FanoutScope) -> anyhow::Result<FanoutOutcome> {
-    reset_fanout_stats();
     let global_sql = rewrite_sql_for_global_fanout(sql);
     log::debug!("cluster fan-out via global catalog ({scope:?}): {global_sql}");
-    let dataframe = query_local_df_in_scope(scope, &global_sql).await?;
-    let stats = take_fanout_stats();
+    let outcome = query_local_outcome_in_scope(scope, &global_sql).await?;
+    let dataframe = outcome.data;
+    let stats = outcome.quality;
     let nodes_queried = 1 + stats.nodes_succeeded + stats.nodes_failed.len();
     finish_fanout(
         dataframe,
@@ -214,7 +226,7 @@ async fn broadcast_from_coordinator(sql: &str) -> anyhow::Result<FanoutOutcome>
 
     let node_aggregators = node_aggregator_peers();
     meta.node_aggregators_queried = node_aggregators.len();
-    let client = HttpPeerQueryClient;
+    let client = HttpPeerQueryClient::new(core_service()?);
     for (node, result) in query_node_peers(&client, node_aggregators, sql).await {
         match result {
             Ok(outcome) => {
@@ -254,7 +266,7 @@ async fn broadcast_from_current_rank(
     meta.scope = scope.as_str().into();
     let peers = peers_for_scope(scope);
     let peer_count = peers.len();
-    let client = HttpPeerQueryClient;
+    let client = HttpPeerQueryClient::new(core_service()?);
 
     if scope == FanoutScope::Coordinator {
         meta.node_aggregators_queried = peer_count;
diff --git a/probing/server/src/server/cluster_fanout/executor.rs b/probing/server/src/server/cluster_fanout/executor.rs
index 8e4e79f9..001e3de5 100644
--- a/probing/server/src/server/cluster_fanout/executor.rs
+++ b/probing/server/src/server/cluster_fanout/executor.rs
@@ -1,5 +1,4 @@
 use futures_util::stream::{self, StreamExt};
-use probing_core::core::federation::remote_fanout_concurrency;
 use probing_proto::prelude::{DataFrame, Node};
 
 use super::transport::PeerQueryClient;
@@ -11,6 +10,7 @@ pub(super) async fn query_leaf_peers<C: PeerQueryClient>(
     sql: &str,
 ) -> Vec<(Node, anyhow::Result<DataFrame>)> {
     let sql = sql.to_string();
+    let request_count = peers.len().max(1);
     stream::iter(peers)
         .map(|node| {
             let sql = sql.clone();
@@ -19,7 +19,7 @@ pub(super) async fn query_leaf_peers<C: PeerQueryClient>(
                 (node, result)
             }
         })
-        .buffer_unordered(remote_fanout_concurrency())
+        .buffer_unordered(request_count)
         .collect()
         .await
 }
@@ -30,6 +30,7 @@ pub(super) async fn query_node_peers<C: PeerQueryClient>(
     sql: &str,
 ) -> Vec<(Node, anyhow::Result<FanoutOutcome>)> {
     let sql = sql.to_string();
+    let request_count = peers.len().max(1);
     stream::iter(peers)
         .map(|node| {
             let sql = sql.clone();
@@ -38,7 +39,7 @@ pub(super) async fn query_node_peers<C: PeerQueryClient>(
                 (node, result)
             }
         })
-        .buffer_unordered(remote_fanout_concurrency())
+        .buffer_unordered(request_count)
         .collect()
         .await
 }
diff --git a/probing/server/src/server/cluster_fanout/transport.rs b/probing/server/src/server/cluster_fanout/transport.rs
index 6d43c9c9..c98709a2 100644
--- a/probing/server/src/server/cluster_fanout/transport.rs
+++ b/probing/server/src/server/cluster_fanout/transport.rs
@@ -1,57 +1,279 @@
+use std::sync::{Arc, LazyLock};
+
 use async_trait::async_trait;
 use datafusion::error::{DataFusionError, Result as DataFusionResult};
+use http_body_util::{BodyExt, Full};
+use hyper::body::Bytes;
+use hyper::client::conn;
+use hyper::{Method, Request};
+use hyper_util::rt::TokioIo;
 use probing_core::core::federation::{
-    fanout_strict_enabled, remote_query_timeout, FanoutScope, FanoutStats, PeerQueryOutcome,
-    PeerQueryTransport,
+    fanout_strict_enabled, remote_fanout_concurrency, remote_query_timeout, FanoutHttpMethod,
+    FanoutHttpRequest, FanoutHttpResponse, FanoutScope, FanoutService, FanoutStats,
+    PeerQueryOutcome,
 };
 use probing_proto::prelude::*;
+use tokio::runtime::{Builder, Runtime};
+use tokio::sync::Semaphore;
 
 use super::types::FanoutOutcome;
 use crate::auth::peer_auth_header_value;
 
+const FANOUT_WORKER_THREADS_ENV: &str = "PROBING_FANOUT_WORKER_THREADS";
+const DEFAULT_FANOUT_WORKER_THREADS: usize = 4;
+
 #[async_trait]
 pub(super) trait PeerQueryClient: Send + Sync {
     async fn query_leaf(&self, addr: &str, sql: &str) -> anyhow::Result<DataFrame>;
     async fn query_node(&self, addr: &str, sql: &str) -> anyhow::Result<FanoutOutcome>;
 }
 
-#[derive(Debug, Default, Clone, Copy)]
-pub(super) struct HttpPeerQueryClient;
+#[derive(Clone)]
+pub(super) struct HttpPeerQueryClient {
+    service: Arc<dyn FanoutService>,
+}
 
-#[derive(Debug, Default)]
-struct HttpFederationPeerTransport;
+impl HttpPeerQueryClient {
+    pub(super) fn new(service: Arc<dyn FanoutService>) -> Self {
+        Self { service }
+    }
+}
+
+/// Shared HTTP fan-out implementation with a runtime isolated from Axum and
+/// DataFusion's caller runtime. All distributed SQL and extension requests are
+/// dispatched here, while their public endpoints remain unchanged.
+struct HttpFanoutService {
+    runtime: Runtime,
+    permits: Arc<Semaphore>,
+}
+
+impl std::fmt::Debug for HttpFanoutService {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("HttpFanoutService")
+            .field("available_permits", &self.permits.available_permits())
+            .finish_non_exhaustive()
+    }
+}
+
+impl HttpFanoutService {
+    fn create() -> anyhow::Result<Self> {
+        let worker_threads = fanout_worker_threads();
+        let runtime = Builder::new_multi_thread()
+            .worker_threads(worker_threads)
+            .thread_name("probing-fanout")
+            .enable_all()
+            .build()?;
+        log::info!(
+            "initialized isolated fan-out runtime: workers={worker_threads}, concurrency={}",
+            remote_fanout_concurrency()
+        );
+        Ok(Self {
+            runtime,
+            permits: Arc::new(Semaphore::new(remote_fanout_concurrency())),
+        })
+    }
+
+    async fn dispatch(
+        &self,
+        addr: &str,
+        request: FanoutHttpRequest,
+    ) -> DataFusionResult<FanoutHttpResponse> {
+        let addr = normalize_peer_addr(addr);
+        let timeout = request.timeout;
+        let permits = self.permits.clone();
+        self.runtime
+            .spawn(async move {
+                let request_addr = addr.clone();
+                tokio::time::timeout(timeout, async move {
+                    let _permit = permits
+                        .acquire_owned()
+                        .await
+                        .map_err(|_| anyhow::anyhow!("fan-out concurrency controller is closed"))?;
+                    send_http(&request_addr, request).await
+                })
+                .await
+                .map_err(|_| {
+                    anyhow::anyhow!("fan-out request to {addr} timed out after {timeout:?}")
+                })?
+            })
+            .await
+            .map_err(|error| transport_error(anyhow::Error::new(error)))?
+            .map_err(transport_error)
+    }
+}
 
 #[derive(Debug)]
-struct PeerTransportError(anyhow::Error);
+struct FanoutTransportError(anyhow::Error);
 
-impl std::fmt::Display for PeerTransportError {
+impl std::fmt::Display for FanoutTransportError {
     fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         write!(formatter, "{:#}", self.0)
     }
 }
 
-impl std::error::Error for PeerTransportError {}
+impl std::error::Error for FanoutTransportError {}
 
 fn transport_error(error: anyhow::Error) -> DataFusionError {
-    DataFusionError::External(Box::new(PeerTransportError(error)))
+    DataFusionError::External(Box::new(FanoutTransportError(error)))
 }
 
-impl PeerQueryTransport for HttpFederationPeerTransport {
-    fn query(
+fn fanout_worker_threads() -> usize {
+    std::env::var(FANOUT_WORKER_THREADS_ENV)
+        .ok()
+        .and_then(|value| value.trim().parse::<usize>().ok())
+        .filter(|value| *value > 0)
+        .unwrap_or(DEFAULT_FANOUT_WORKER_THREADS)
+}
+
+fn normalize_peer_addr(addr: &str) -> String {
+    addr.trim()
+        .trim_start_matches("http://")
+        .trim_start_matches("https://")
+        .trim_end_matches('/')
+        .to_string()
+}
+
+async fn send_http(addr: &str, request: FanoutHttpRequest) -> anyhow::Result<FanoutHttpResponse> {
+    let stream = tokio::net::TcpStream::connect(addr).await?;
+    let io = TokioIo::new(stream);
+    let (mut sender, connection) = conn::http1::handshake(io).await?;
+    tokio::spawn(async move {
+        if let Err(error) = connection.await {
+            log::debug!("fan-out HTTP connection error: {error}");
+        }
+    });
+
+    let method = match request.method {
+        FanoutHttpMethod::Get => Method::GET,
+        FanoutHttpMethod::Post => Method::POST,
+        FanoutHttpMethod::Put => Method::PUT,
+    };
+    let mut builder = Request::builder()
+        .method(method)
+        .uri(&request.path)
+        .header("Host", addr);
+    if let Some(content_type) = request.content_type {
+        builder = builder.header("Content-Type", content_type);
+    }
+    if let Some(value) = peer_auth_header_value() {
+        builder = builder.header("Authorization", value);
+    }
+    let response = sender
+        .send_request(builder.body(Full::<Bytes>::from(request.body))?)
+        .await?;
+    let status = response.status().as_u16();
+    let body = response.into_body().collect().await?.to_bytes().to_vec();
+    Ok(FanoutHttpResponse { status, body })
+}
+
+#[async_trait]
+impl FanoutService for HttpFanoutService {
+    async fn query_peer(
         &self,
         addr: &str,
         sql: &str,
         scope: FanoutScope,
     ) -> DataFusionResult<PeerQueryOutcome> {
         if scope == FanoutScope::Coordinator {
-            return remote_node_aggregate_blocking(addr, sql)
+            let body = serde_json::to_vec(&serde_json::json!({
+                "expr": sql,
+                "cluster": true,
+                "hierarchical": true,
+                "scope": "node",
+            }))
+            .map_err(|error| transport_error(anyhow::Error::new(error)))?;
+            let response = self
+                .request_peer(
+                    addr,
+                    FanoutHttpRequest {
+                        method: FanoutHttpMethod::Post,
+                        path: "/apis/cluster/query".into(),
+                        content_type: Some("application/json".into()),
+                        body,
+                        timeout: remote_query_timeout(),
+                    },
+                )
+                .await?;
+            let text = String::from_utf8(response.body)
+                .map_err(|error| transport_error(anyhow::Error::new(error)))?;
+            return parse_node_response(response.status, &text, addr)
                 .map(peer_query_outcome)
                 .map_err(transport_error);
         }
-        remote_query_df_blocking(addr, sql)
+
+        let body = serde_json::to_vec(&Message::new(Query {
+            expr: sql.to_string(),
+            ..Default::default()
+        }))
+        .map_err(|error| transport_error(anyhow::Error::new(error)))?;
+        let response = self
+            .request_peer(
+                addr,
+                FanoutHttpRequest {
+                    method: FanoutHttpMethod::Post,
+                    path: "/query".into(),
+                    content_type: Some("application/json".into()),
+                    body,
+                    timeout: remote_query_timeout(),
+                },
+            )
+            .await?;
+        let text = String::from_utf8(response.body)
+            .map_err(|error| transport_error(anyhow::Error::new(error)))?;
+        parse_leaf_response(response.status, &text, addr)
             .map(PeerQueryOutcome::complete)
             .map_err(transport_error)
     }
+
+    async fn request_peer(
+        &self,
+        addr: &str,
+        request: FanoutHttpRequest,
+    ) -> DataFusionResult<FanoutHttpResponse> {
+        self.dispatch(addr, request).await
+    }
+}
+
+static HTTP_FANOUT_SERVICE: LazyLock<Result<Arc<HttpFanoutService>, String>> =
+    LazyLock::new(|| {
+        HttpFanoutService::create()
+            .map(Arc::new)
+            .map_err(|error| format!("{error:#}"))
+    });
+
+fn http_service() -> anyhow::Result<Arc<HttpFanoutService>> {
+    HTTP_FANOUT_SERVICE
+        .as_ref()
+        .cloned()
+        .map_err(|error| anyhow::anyhow!("failed to initialize fan-out service: {error}"))
+}
+
+pub(crate) fn core_service() -> anyhow::Result<Arc<dyn FanoutService>> {
+    Ok(http_service()? as Arc<dyn FanoutService>)
+}
+
+pub(crate) fn request_peer_blocking(
+    addr: &str,
+    request: FanoutHttpRequest,
+) -> anyhow::Result<FanoutHttpResponse> {
+    let service = http_service()?;
+    let runtime_handle = service.runtime.handle().clone();
+    let addr = addr.to_string();
+    let wait_timeout = request
+        .timeout
+        .saturating_add(std::time::Duration::from_secs(1));
+    let (sender, receiver) = std::sync::mpsc::sync_channel(1);
+    runtime_handle.spawn(async move {
+        let result = service
+            .request_peer(&addr, request)
+            .await
+            .map_err(anyhow::Error::new);
+        let _ = sender.send(result);
+    });
+    receiver
+        .recv_timeout(wait_timeout)
+        .map_err(|error| anyhow::anyhow!("fan-out service response wait failed: {error}"))?
 }
 
 fn peer_query_outcome(outcome: FanoutOutcome) -> PeerQueryOutcome {
@@ -67,76 +289,47 @@ fn peer_query_outcome(outcome: FanoutOutcome) -> PeerQueryOutcome {
     )
 }
 
-pub(crate) fn core_transport() -> std::sync::Arc<dyn PeerQueryTransport> {
-    std::sync::Arc::new(HttpFederationPeerTransport)
-}
-
 #[async_trait]
 impl PeerQueryClient for HttpPeerQueryClient {
     async fn query_leaf(&self, addr: &str, sql: &str) -> anyhow::Result<DataFrame> {
-        remote_query_df(addr, sql).await
+        let outcome = self
+            .service
+            .query_peer(addr, sql, FanoutScope::Flat)
+            .await
+            .map_err(anyhow::Error::new)?;
+        Ok(outcome.dataframe)
     }
 
     async fn query_node(&self, addr: &str, sql: &str) -> anyhow::Result<FanoutOutcome> {
-        remote_node_aggregate(addr, sql).await
+        let body = serde_json::to_vec(&serde_json::json!({
+            "expr": sql,
+            "cluster": true,
+            "hierarchical": true,
+            "scope": "node",
+        }))?;
+        let response = self
+            .service
+            .request_peer(
+                addr,
+                FanoutHttpRequest {
+                    method: FanoutHttpMethod::Post,
+                    path: "/apis/cluster/query".into(),
+                    content_type: Some("application/json".into()),
+                    body,
+                    timeout: remote_query_timeout(),
+                },
+            )
+            .await
+            .map_err(anyhow::Error::new)?;
+        let text = String::from_utf8(response.body)?;
+        parse_node_response(response.status, &text, addr)
     }
 }
 
 pub async fn remote_query_df(addr: &str, sql: &str) -> anyhow::Result<DataFrame> {
-    let addr = addr.to_string();
-    let sql = sql.to_string();
-    tokio::task::spawn_blocking(move || remote_query_df_blocking(&addr, &sql)).await?
-}
-
-fn remote_query_df_blocking(addr: &str, sql: &str) -> anyhow::Result<DataFrame> {
-    let url = format!("http://{addr}/query");
-    let request = Message::new(Query {
-        expr: sql.to_string(),
-        ..Default::default()
-    });
-    let body = serde_json::to_string(&request)?;
-    let response = send_post_blocking(url, None, body)?;
-    parse_leaf_response(response.0, &response.1, addr)
-}
-
-async fn remote_node_aggregate(addr: &str, sql: &str) -> anyhow::Result<FanoutOutcome> {
-    let addr = addr.to_string();
-    let sql = sql.to_string();
-    tokio::task::spawn_blocking(move || remote_node_aggregate_blocking(&addr, &sql)).await?
-}
-
-fn remote_node_aggregate_blocking(addr: &str, sql: &str) -> anyhow::Result<FanoutOutcome> {
-    let url = format!("http://{addr}/apis/cluster/query");
-    let body = serde_json::to_string(&serde_json::json!({
-        "expr": sql,
-        "cluster": true,
-        "hierarchical": true,
-        "scope": "node",
-    }))?;
-    let response = send_post_blocking(url, Some("application/json"), body)?;
-    parse_node_response(response.0, &response.1, addr)
-}
-
-fn send_post_blocking(
-    url: String,
-    content_type: Option<&'static str>,
-    body: String,
-) -> anyhow::Result<(u16, String)> {
-    let timeout = remote_query_timeout();
-    let mut request = ureq::post(&url)
-        .config()
-        .timeout_global(Some(timeout))
-        .build();
-    if let Some(content_type) = content_type {
-        request = request.header("Content-Type", content_type);
-    }
-    if let Some(value) = peer_auth_header_value() {
-        request = request.header("Authorization", value);
-    }
-    let response = request.send(body).map_err(anyhow::Error::new)?;
-    let status = response.status().as_u16();
-    let text = response.into_body().read_to_string()?;
-    Ok((status, text))
+    HttpPeerQueryClient::new(core_service()?)
+        .query_leaf(addr, sql)
+        .await
 }
 
 fn parse_leaf_response(status: u16, text: &str, addr: &str) -> anyhow::Result<DataFrame> {
@@ -214,4 +407,24 @@ mod tests {
         assert_eq!(outcome.stats.peer_batches_dropped, 1);
         assert!(outcome.stats.partial);
     }
+
+    #[test]
+    fn worker_count_rejects_zero() {
+        std::env::set_var(FANOUT_WORKER_THREADS_ENV, "0");
+        assert_eq!(fanout_worker_threads(), DEFAULT_FANOUT_WORKER_THREADS);
+        std::env::remove_var(FANOUT_WORKER_THREADS_ENV);
+    }
+
+    #[test]
+    fn fanout_tasks_run_on_named_isolated_workers() {
+        let service = HttpFanoutService::create().expect("fan-out runtime");
+        let task = service.runtime.spawn(async {
+            std::thread::current()
+                .name()
+                .unwrap_or_default()
+                .to_string()
+        });
+        let thread_name = service.runtime.block_on(task).expect("fan-out task");
+        assert_eq!(thread_name, "probing-fanout");
+    }
 }
diff --git a/probing/server/src/server/query_dto.rs b/probing/server/src/server/query_dto.rs
index 08300689..6f23d705 100644
--- a/probing/server/src/server/query_dto.rs
+++ b/probing/server/src/server/query_dto.rs
@@ -82,10 +82,8 @@ async fn convert_engine_response_to_dto(
             let meta_partial = message_response
                 .meta
                 .as_ref()
-                .and_then(|m| m.get("fanout"))
-                .and_then(|f| f.get("partial"))
-                .and_then(|v| v.as_bool())
-                .unwrap_or(false);
+                .and_then(|meta| meta.fanout.as_ref())
+                .is_some_and(|quality| quality.is_partial());
             let partial = partial || meta_partial;
 
             let response_dto = probing_proto::dto::query::QueryResponseDto::success(
diff --git a/probing/server/tests/hierarchical_cluster_report.rs b/probing/server/tests/hierarchical_cluster_report.rs
index 3a78e0f8..6f0a0798 100644
--- a/probing/server/tests/hierarchical_cluster_report.rs
+++ b/probing/server/tests/hierarchical_cluster_report.rs
@@ -296,7 +296,7 @@ fn authenticated_peer_traffic_supports_heartbeat_and_fanout() {
             let transport = probing_core::ENGINE
                 .read()
                 .await
-                .peer_query_transport()
+                .fanout_service()
                 .expect("composition root transport");
             ProbeClusterExecutor::execute_remote_for_scope(
                 Some(&transport),
@@ -304,6 +304,7 @@ fn authenticated_peer_traffic_supports_heartbeat_and_fanout() {
                 "SELECT 1",
                 FanoutScope::Flat,
             )
+            .await
             .expect("authenticated core leaf fan-out");
             ProbeClusterExecutor::execute_remote_for_scope(
                 Some(&transport),
@@ -311,6 +312,7 @@ fn authenticated_peer_traffic_supports_heartbeat_and_fanout() {
                 "SELECT 1",
                 FanoutScope::Coordinator,
             )
+            .await
             .expect("authenticated hierarchical fan-out");
 
             persist_auth_token("").await.expect("clear auth token");
diff --git a/python/probing/__init__.py b/python/probing/__init__.py
index 543c7018..40be5551 100644
--- a/python/probing/__init__.py
+++ b/python/probing/__init__.py
@@ -47,7 +47,7 @@ def is_enabled():
     _get_python_frames = _core._get_python_frames
     register_table_docs = _core.register_table_docs
 
-    from probing.core.engine import load_extension, query
+    from probing.core.engine import load_extension, query, query_outcome
     from probing.parallel import clear_role, current_role, set_role
     from probing.tracing import (
         attach_training_phases,
@@ -100,6 +100,7 @@ def is_enabled():
         "disable_tracer",
         "is_enabled",
         "query",
+        "query_outcome",
         "load_extension",
         "span",
         "event",
diff --git a/python/probing/core/__init__.py b/python/probing/core/__init__.py
index a9dbd3ce..10b4deb6 100644
--- a/python/probing/core/__init__.py
+++ b/python/probing/core/__init__.py
@@ -16,7 +16,14 @@
 - `load_extension`: Load dynamic extensions into the engine.
 """
 
-from .engine import load_extension, query
+from .engine import QueryOutcome, QueryQuality, load_extension, query, query_outcome
 from .table import table
 
-__all__ = ["table", "query", "load_extension"]
+__all__ = [
+    "table",
+    "query",
+    "query_outcome",
+    "QueryOutcome",
+    "QueryQuality",
+    "load_extension",
+]
diff --git a/python/probing/core/engine.py b/python/probing/core/engine.py
index a7fa5339..0fd7c13d 100644
--- a/python/probing/core/engine.py
+++ b/python/probing/core/engine.py
@@ -9,9 +9,24 @@
 from __future__ import annotations
 
 import json
+from dataclasses import dataclass, field
 from typing import Any
 
 
+@dataclass(frozen=True)
+class QueryQuality:
+    nodes_succeeded: int = 0
+    nodes_failed: list[str] = field(default_factory=list)
+    peer_batches_dropped: int = 0
+    partial: bool = False
+
+
+@dataclass(frozen=True)
+class QueryOutcome:
+    data: Any
+    quality: QueryQuality
+
+
 def _col_values(column: Any) -> list[Any]:
     if isinstance(column, dict):
         return next(iter(column.values()))
@@ -51,6 +66,23 @@ def query(sql: str) -> "DataFrame":  # noqa: F821
         return ret
 
 
+def query_outcome(sql: str) -> QueryOutcome:
+    """Execute SQL and preserve distributed completeness metadata."""
+    from probing import _core
+
+    payload = json.loads(_core.query_outcome_json(sql))
+    raw_quality = payload.get("quality") or {}
+    quality = QueryQuality(
+        nodes_succeeded=int(raw_quality.get("nodes_succeeded", 0)),
+        nodes_failed=list(raw_quality.get("nodes_failed") or []),
+        peer_batches_dropped=int(raw_quality.get("peer_batches_dropped", 0)),
+        partial=bool(raw_quality.get("partial", False)),
+    )
+    raw_data = payload.get("data")
+    data = None if raw_data is None else _dataframe_from_proto(raw_data)
+    return QueryOutcome(data=data, quality=quality)
+
+
 def load_extension(statement: str):
     """Load a Rust extension into the probing library."""
     import importlib
diff --git a/src/lib.rs b/src/lib.rs
index c71e6f14..c0df2379 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -8,7 +8,7 @@ use probing_cli::pyo3::cli_main;
 use probing_core::{install_panic_hook, register_python_main_thread};
 use probing_python::extensions::python::{register_table_docs, ExternalTable};
 use probing_python::features::python::bindings;
-use probing_python::features::python::bindings::query_json;
+use probing_python::features::python::bindings::{query_json, query_outcome_json};
 use probing_python::features::python::tracing;
 use probing_python::features::stacktrace::vm::{
     _get_python_frames, _get_python_stacks, disable_tracer, enable_tracer, initialize_globals,
@@ -220,6 +220,7 @@ fn _core(m: &Bound<'_, PyModule>) -> PyResult<()> {
 
     // Register all functions
     m.add_function(wrap_pyfunction!(query_json, m)?)?;
+    m.add_function(wrap_pyfunction!(query_outcome_json, m)?)?;
     m.add_function(wrap_pyfunction!(enable_tracer, m)?)?;
     m.add_function(wrap_pyfunction!(disable_tracer, m)?)?;
     m.add_function(wrap_pyfunction!(_get_python_stacks, m)?)?;
diff --git a/tests/regression/rust/probing/core/extension_routing_spec.rs b/tests/regression/rust/probing/core/extension_routing_spec.rs
index 74f4dcc3..475eae8b 100644
--- a/tests/regression/rust/probing/core/extension_routing_spec.rs
+++ b/tests/regression/rust/probing/core/extension_routing_spec.rs
@@ -4,13 +4,20 @@ use std::collections::HashMap;
 use std::sync::Arc;
 
 use async_trait::async_trait;
-use probing_core::core::{EngineError, ProbeExtension, ProbeExtensionCall, ProbeExtensionManager};
+use probing_core::core::{
+    EngineError, ExtensionRoute, ProbeExtension, ProbeExtensionCall, ProbeExtensionConfig,
+    ProbeExtensionManager,
+};
 
 #[derive(Debug)]
 struct PythonextStub;
 
 #[async_trait]
 impl ProbeExtensionCall for PythonextStub {
+    fn routes(&self) -> Vec<ExtensionRoute> {
+        probing_python::extensions::PythonExt::default().routes()
+    }
+
     async fn call(
         &self,
         path: &str,
@@ -27,6 +34,8 @@ impl ProbeExtension for PythonextStub {
     }
 }
 
+impl ProbeExtensionConfig for PythonextStub {}
+
 fn load_spec() -> serde_json::Value {
     let path = probing_rust_regression::api_spec_path();
     let text = std::fs::read_to_string(path).expect("read api_spec.json");
@@ -40,7 +49,8 @@ async fn register_pythonext_stub() -> ProbeExtensionManager {
             "pythonext".to_string(),
             Arc::new(tokio::sync::Mutex::new(PythonextStub)),
         )
-        .await;
+        .await
+        .unwrap();
     manager
 }
 
diff --git a/tests/regression/rust/probing/core/federation_tests.rs b/tests/regression/rust/probing/core/federation_tests.rs
index 82997d28..5818dcf0 100644
--- a/tests/regression/rust/probing/core/federation_tests.rs
+++ b/tests/regression/rust/probing/core/federation_tests.rs
@@ -8,9 +8,9 @@ use probing_core::core::cluster::{
     reset_cluster_for_tests, update_node, HIERARCHICAL_METADATA_UNAVAILABLE,
 };
 use probing_core::core::federation::{
-    set_remote_query_hook, take_fanout_stats, FanoutScope, FanoutStats, PeerQueryOutcome,
-    PeerQueryTransport, FEDERATION_TAG_COLUMNS, GLOBAL_CATALOG, PROBE_ADDR_COL, PROBE_HOST_COL,
-    PROBE_LOCAL_RANK_COL, PROBE_NODE_RANK_COL, PROBE_RANK_COL, PROBE_ROLE_COL,
+    set_remote_query_hook, FanoutHttpRequest, FanoutHttpResponse, FanoutScope, FanoutService,
+    FanoutStats, PeerQueryOutcome, FEDERATION_TAG_COLUMNS, GLOBAL_CATALOG, PROBE_ADDR_COL,
+    PROBE_HOST_COL, PROBE_LOCAL_RANK_COL, PROBE_NODE_RANK_COL, PROBE_RANK_COL, PROBE_ROLE_COL,
 };
 use probing_core::core::{Engine, ProbeDataSource};
 use probing_proto::prelude::{Node, Seq};
@@ -101,8 +101,9 @@ impl fmt::Debug for PartialSubtreeTransport {
     }
 }
 
-impl PeerQueryTransport for PartialSubtreeTransport {
-    fn query(
+#[async_trait::async_trait]
+impl FanoutService for PartialSubtreeTransport {
+    async fn query_peer(
         &self,
         addr: &str,
         sql: &str,
@@ -110,10 +111,9 @@ impl PeerQueryTransport for PartialSubtreeTransport {
     ) -> datafusion::error::Result<PeerQueryOutcome> {
         assert_eq!(addr, self.peer_addr);
         assert_eq!(scope, FanoutScope::Coordinator);
-        let dataframe = futures::executor::block_on(self.peer_engine.async_query(sql))?
-            .ok_or_else(|| {
-                datafusion::error::DataFusionError::Execution("missing peer data".into())
-            })?;
+        let dataframe = self.peer_engine.async_query(sql).await?.ok_or_else(|| {
+            datafusion::error::DataFusionError::Execution("missing peer data".into())
+        })?;
         Ok(PeerQueryOutcome::with_stats(
             dataframe,
             FanoutStats {
@@ -124,6 +124,14 @@ impl PeerQueryTransport for PartialSubtreeTransport {
             },
         ))
     }
+
+    async fn request_peer(
+        &self,
+        _addr: &str,
+        _request: FanoutHttpRequest,
+    ) -> datafusion::error::Result<FanoutHttpResponse> {
+        unreachable!("this regression service only executes SQL")
+    }
 }
 
 impl FederatedTestCluster {
@@ -225,7 +233,7 @@ async fn global_query_preserves_nested_partial_transport_stats() {
     let local_table =
         GenericTableProbeDataSource::single_column_table("metrics", "demo", "v", vec![0]);
     let engine = Engine::builder()
-        .with_peer_query_transport(Arc::new(PartialSubtreeTransport {
+        .with_fanout_service(Arc::new(PartialSubtreeTransport {
             peer_engine,
             peer_addr,
         }))
@@ -234,18 +242,26 @@ async fn global_query_preserves_nested_partial_transport_stats() {
         .await
         .expect("coordinator engine");
 
-    let dataframe = engine
-        .async_query("SELECT v FROM global.demo.metrics ORDER BY v")
+    let outcome = engine
+        .query_outcome("SELECT v FROM global.demo.metrics ORDER BY v")
         .await
-        .expect("global query")
-        .expect("global dataframe");
+        .expect("global query");
+    let dataframe = outcome.data.expect("global dataframe");
     assert_eq!(df_col_i32(&dataframe, "v"), vec![0, 2]);
 
-    let stats = take_fanout_stats();
+    let stats = outcome.quality;
     assert!(stats.partial);
     assert_eq!(stats.nodes_succeeded, 1);
     assert_eq!(stats.nodes_failed, vec!["remote-leaf: timeout"]);
 
+    let data_only_error = engine
+        .async_query("SELECT v FROM global.demo.metrics ORDER BY v")
+        .await
+        .expect_err("data-only API must not hide partial completeness");
+    assert!(data_only_error
+        .to_string()
+        .contains("query returned partial data"));
+
     for key in [
         "RANK",
         "LOCAL_RANK",
@@ -670,15 +686,15 @@ async fn aggregate_pushdown_merges_local_and_peer_sums() {
     let _lock = federation_test_lock().await;
     let cluster = FederatedTestCluster::setup(vec![1, 2, 3], vec![4, 5]).await;
 
-    let df = cluster
+    let outcome = cluster
         .local_engine
-        .async_query("SELECT sum(v) AS total FROM global.demo.metrics")
+        .query_outcome("SELECT sum(v) AS total FROM global.demo.metrics")
         .await
-        .expect("query")
-        .expect("dataframe");
+        .expect("query");
+    let df = outcome.data.expect("dataframe");
 
     assert_eq!(df_col_i64(&df, "total"), vec![15]);
-    let stats = take_fanout_stats();
+    let stats = outcome.quality;
     assert_eq!(stats.nodes_succeeded, 1);
     assert!(stats.nodes_failed.is_empty());
 
@@ -713,19 +729,19 @@ async fn federated_scan_concatenates_local_and_peer_rows_with_tags() {
     let _lock = federation_test_lock().await;
     let cluster = FederatedTestCluster::setup(vec![1, 2], vec![3]).await;
 
-    let df = cluster
+    let outcome = cluster
         .local_engine
-        .async_query("SELECT v, _host FROM global.demo.metrics ORDER BY v")
+        .query_outcome("SELECT v, _host FROM global.demo.metrics ORDER BY v")
         .await
-        .expect("query")
-        .expect("dataframe");
+        .expect("query");
+    let df = outcome.data.expect("dataframe");
 
     assert_eq!(df_col_i32(&df, "v"), vec![1, 2, 3]);
     assert!(df.names.iter().any(|n| n == "_host"));
     let hosts = df_col_str(&df, "_host");
     assert_eq!(hosts, vec!["coord-host", "coord-host", "peer-host"]);
 
-    let stats = take_fanout_stats();
+    let stats = outcome.quality;
     assert_eq!(stats.nodes_succeeded, 1);
 
     cluster.teardown();
diff --git a/tests/unit/probing/core/test_engine.py b/tests/unit/probing/core/test_engine.py
new file mode 100644
index 00000000..bc2f3498
--- /dev/null
+++ b/tests/unit/probing/core/test_engine.py
@@ -0,0 +1,32 @@
+import json
+
+import probing
+
+from probing.core.engine import QueryOutcome, query_outcome
+
+
+def test_query_outcome_preserves_partial_quality(monkeypatch):
+    payload = {
+        "data": {"names": ["rank"], "cols": [{"SeqI32": [0]}], "size": 1},
+        "quality": {
+            "nodes_succeeded": 1,
+            "nodes_failed": ["rank-1: timeout"],
+            "peer_batches_dropped": 2,
+            "partial": True,
+        },
+    }
+    monkeypatch.setattr(
+        probing._core,
+        "query_outcome_json",
+        lambda _sql: json.dumps(payload),
+        raising=False,
+    )
+
+    outcome = query_outcome("select rank from global.demo.metrics")
+
+    assert isinstance(outcome, QueryOutcome)
+    assert outcome.data.to_dict(orient="list") == {"rank": [0]}
+    assert outcome.quality.nodes_succeeded == 1
+    assert outcome.quality.nodes_failed == ["rank-1: timeout"]
+    assert outcome.quality.peer_batches_dropped == 2
+    assert outcome.quality.partial is True
diff --git a/web/src/api/analytics.rs b/web/src/api/analytics.rs
index 81b8e7e0..ab7b212e 100644
--- a/web/src/api/analytics.rs
+++ b/web/src/api/analytics.rs
@@ -6,16 +6,40 @@ use probing_proto::prelude::*;
 impl ApiClient {
     /// Execute SQL query
     pub async fn execute_query(&self, query: &str) -> Result<DataFrame> {
-        self.execute_query_at_path("/query", query).await
+        let outcome = self.execute_query_outcome(query).await?;
+        if outcome.quality.is_partial() {
+            return Err(AppError::Api(format!(
+                "query returned partial data: {} peer(s) failed, {} batch(es) dropped",
+                outcome.quality.nodes_failed.len(),
+                outcome.quality.peer_batches_dropped
+            )));
+        }
+        Ok(outcome.data)
+    }
+
+    /// Execute SQL while preserving distributed completeness as typed data.
+    pub async fn execute_query_outcome(&self, query: &str) -> Result<QueryOutcome<DataFrame>> {
+        self.execute_query_outcome_at_path("/query", query).await
     }
 
     /// Execute SQL query against another local probing process via the current server.
     pub async fn execute_query_local_pid(&self, pid: i32, query: &str) -> Result<DataFrame> {
-        self.execute_query_at_path(&format!("/apis/query/local-pid?pid={pid}"), query)
-            .await
+        let outcome = self
+            .execute_query_outcome_at_path(&format!("/apis/query/local-pid?pid={pid}"), query)
+            .await?;
+        if outcome.quality.is_partial() {
+            return Err(AppError::Api(
+                "local query returned partial data".to_string(),
+            ));
+        }
+        Ok(outcome.data)
     }
 
-    async fn execute_query_at_path(&self, path: &str, query: &str) -> Result<DataFrame> {
+    async fn execute_query_outcome_at_path(
+        &self,
+        path: &str,
+        query: &str,
+    ) -> Result<QueryOutcome<DataFrame>> {
         let request = Message::new(Query {
             expr: query.to_string(),
             ..Default::default()
@@ -24,21 +48,25 @@ impl ApiClient {
         let request_body = serde_json::to_string(&request)
             .map_err(|e| AppError::Api(format!("Failed to serialize request: {}", e)))?;
 
-        let response = self.post_request_with_body(path, request_body).await?;
+        let response = self
+            .post_request_with_body_accepting(path, request_body, &[503])
+            .await?;
 
         let msg: Message<QueryDataFormat> = Self::parse_json(&response)?;
+        let quality = msg.meta.and_then(|meta| meta.fanout).unwrap_or_default();
 
-        match msg.payload {
-            QueryDataFormat::DataFrame(dataframe) => Ok(dataframe),
-            QueryDataFormat::Nil => Ok(DataFrame {
+        let data = match msg.payload {
+            QueryDataFormat::DataFrame(dataframe) => dataframe,
+            QueryDataFormat::Nil => DataFrame {
                 names: vec![],
                 cols: vec![],
                 size: 0,
-            }),
-            QueryDataFormat::Error(err) => Err(AppError::Api(err.message)),
+            },
+            QueryDataFormat::Error(err) => return Err(AppError::Api(err.message)),
             QueryDataFormat::TimeSeries(_) => {
-                Err(AppError::Api("TimeSeries format not supported".to_string()))
+                return Err(AppError::Api("TimeSeries format not supported".to_string()));
             }
-        }
+        };
+        Ok(QueryOutcome::with_quality(data, quality))
     }
 }