fix(api): EOF 阶段到期一律判定超时，恢复的载荷不得转为成功

- 退出阶段与 EOF 阶段统一用 expired 标志：EOF 等待按剩余总期限计时，未完成读取且非请求取消即视为期限已过，即便清理宽限期回收了载荷也只返回超时错误
- EOF 等待挂接 deadline+请求 联合取消令牌，请求取消即刻中断等待；清理宽限期（2s）仅用于回收日志，不再影响结果分类
- 预先取消的请求不启动采集器进程
- 回归：孤儿管道持有至总期限→超时+后代死亡；EOF 等待中取消→延迟<5s+后代死亡；预取消→无进程启动；保留成功/stderr 洪泛等原行为
- 验证：聚焦 ProcessCollector 11/11，全量 Domain 19 / Web 17 / API 32 通过（构建 0 警告）；实机挂起采集器 HTTP 503 2.3s 且无进程残留

1 files changed, 60 insertions, 7 deletions

diff --git a/tests/FundLab.Api.Tests/ProcessCollectorTests.fs b/tests/FundLab.Api.Tests/ProcessCollectorTests.fs
index 32009bf..ee3f016 100644
--- a/tests/FundLab.Api.Tests/ProcessCollectorTests.fs
+++ b/tests/FundLab.Api.Tests/ProcessCollectorTests.fs
@@ -6,6 +6,7 @@ module ProcessCollectorTests =
     open System.Diagnostics
     open System.IO
     open System.Threading
+    open System.Threading.Tasks
     open Xunit
     open FundLab.Api
 
@@ -127,25 +128,77 @@ module ProcessCollectorTests =
             Directory.Delete(dir, true)
 
     [<Fact>]
-    let ``collector recovers payload and reaps pipe-holding orphan after parent exit`` () =
+    let ``collector rejects orphan-held pipes at the total exit and EOF deadline`` () =
         let dir = fixtureDir ()
 
         try
             let script = orphanScript dir
-            let collector = ProcessMarketDataCollector("/bin/sh", script, None, 5) :> IMarketDataCollector
+            let collector = ProcessMarketDataCollector("/bin/sh", script, None, 2) :> IMarketDataCollector
             let stopwatch = Stopwatch.StartNew()
 
             let result = collector.Search("000001", CancellationToken.None)
             stopwatch.Stop()
 
             match result with
-            | Ok raw ->
-                Assert.Equal(searchEnvelope, raw)
-                Assert.True(stopwatch.Elapsed < TimeSpan.FromSeconds(20.0))
+            | Ok raw -> Assert.Fail(sprintf "recovered payload after expired deadline: %s" raw)
             | Error message ->
-                Assert.Fail(sprintf "expected recovered payload, got error %s" message)
+                Assert.Equal("collector did not finish within 2 seconds", message)
+                Assert.DoesNotContain(dir, message)
+                Assert.DoesNotContain(secretSentinel, message)
+
+            Assert.True(stopwatch.Elapsed >= TimeSpan.FromSeconds(1.8))
+            Assert.True(stopwatch.Elapsed < TimeSpan.FromSeconds(15.0))
+            Assert.True(waitForPidDeath (recordedPid dir), "pipe-holding orphan survived the EOF deadline kill")
+        finally
+            Directory.Delete(dir, true)
+
+    [<Fact>]
+    let ``cancellation during EOF wait interrupts promptly and kills descendants`` () =
+        let dir = fixtureDir ()
+
+        try
+            let script = orphanScript dir
+            let collector = ProcessMarketDataCollector("/bin/sh", script, None, 30) :> IMarketDataCollector
+            use cts = new CancellationTokenSource()
+
+            let searchTask = Task.Run(fun () -> collector.Search("000001", cts.Token))
+            Thread.Sleep(700)
+
+            let stopwatch = Stopwatch.StartNew()
+            cts.Cancel()
+            let completed = searchTask.Wait(10000)
+            stopwatch.Stop()
+
+            Assert.True(completed, "search did not return promptly after cancellation")
+
+            match searchTask.Result with
+            | Error message -> Assert.Equal("collector run was cancelled", message)
+            | Ok raw -> Assert.Fail(sprintf "expected cancellation, got %s" raw)
+
+            Assert.True(stopwatch.Elapsed < TimeSpan.FromSeconds(5.0), "cancellation during EOF wait was not prompt")
+            Assert.True(waitForPidDeath (recordedPid dir), "pipe-holding orphan survived EOF-wait cancellation")
+        finally
+            Directory.Delete(dir, true)
+
+    [<Fact>]
+    let ``pre-cancelled request does not launch the collector`` () =
+        let dir = fixtureDir ()
+
+        try
+            let script =
+                writeScript dir "recording.sh" ("echo $$ > pidfile\nprintf '%s' '" + searchEnvelope + "'\n")
+
+            let collector = ProcessMarketDataCollector("/bin/sh", script, None, 30) :> IMarketDataCollector
+            use cts = new CancellationTokenSource()
+            cts.Cancel()
+
+            match collector.Search("000001", cts.Token) with
+            | Error message ->
+                Assert.Equal("collector run was cancelled", message)
+                Assert.DoesNotContain(dir, message)
+            | Ok raw -> Assert.Fail(sprintf "expected pre-cancel, got %s" raw)
 
-            Assert.True(waitForPidDeath (recordedPid dir), "pipe-holding orphan survived parent exit")
+            Assert.False(File.Exists(Path.Combine(dir, "pidfile")), "collector process was launched despite pre-cancelled request")
         finally
             Directory.Delete(dir, true)