retainForPayment

Keep delegate alive for the duration of one payment; the returned lambda releases it.

LOAD-BEARING, not a convenience. PKPaymentAuthorizationController.setDelegate — like most UIKit delegate and target properties — holds its delegate weakly. A delegate allocated inside a suspend fun has no other strong referrer, so ARC frees it as soon as the call frame that created it suspends. The sheet then stays on screen with a dead delegate: no authorization callback ever fires, the coroutine never resumes, and the payment hangs forever with no error to report. It is invisible in a debug build with a breakpoint holding the frame, and reproducible in release.

The host owns the strong reference so a provider cannot leak it across view-controller recreation — the same lifetime discipline as AndroidPaymentHost.registerForResult, which owns registration/unregistration rather than handing a provider the registry.

Call the returned lambda in a finally, so cancellation releases it too.