AppFlowContextFactory should give delegate its own context to destroy.

If you're suggesting that I create a new system service to provide the parent…yeah, I could do that. But it's still surprising that I have to. Why should I expect a destroy method to be called with anything other than the thing I created in the first place?