perf: make interface destructors protected and non-virtual (#361)

Every toolbox interface declared `virtual ~I() = default`. The library
and its embedded users never destroy an object through an interface
pointer, but the virtual destructor still puts a deleting destructor
in each implementation's vtable. That destructor calls operator
delete, which links malloc/free into firmware that never allocates.
Under multiple inheritance it also adds one thunk per base.

All 24 library interfaces now declare `~I() = default` in a protected
section, as EMIL does. SynchronousPidController gets one too, so the
derived interface does not reopen a public non-virtual destructor.
Deleting through an interface pointer is now a compile error.

Compiled at -O2, a translation unit that instantiates
Lqr<float, 2, 1, 300> used to emit two deleting destructors and a
reference to operator delete. It now emits neither.

Code that owned windows through std::unique_ptr<Window> holds them
differently now:
- TestWindowing holds each window on the stack.
- The FFT and PSD simulators pick a static, stateless window by
  reference.

The simulator's own Plant interface keeps its virtual destructor: it
is host-only and owned through std::unique_ptr<Plant>.

The rule is updated in AGENTS.md, CLAUDE.md,
.github/copilot-instructions.md, the reviewer agents and the C++
instructions.

Closes #359


Claude-Session: https://claude.ai/code/session_01Q53m7MZDmHwocmKbhhd2o5

Co-authored-by: Claude <noreply@anthropic.com>

Author: gabrielfrasantos

.claude/agents/reviewer.md

@@ -48,7 +48,7 @@ End with totals + verdict: APPROVE / REQUEST CHANGES.
 - [ ] SOLID: one concern per class, constructor injection, depend on abstractions, no duplicated logic.
 
 **Interfaces & errors (WARNING)**
-- [ ] `virtual ~I() = default` — never `= 0`. No exceptions — `std::optional`/status enums.
+- [ ] Interfaces: `protected:` non-virtual `~I() = default` — no `virtual` or `= 0` destructor, no ownership or deletion through an interface pointer. No exceptions — `std::optional`/status enums.
 
 **Testing (WARNING)**
 - [ ] `TEST_F` on `float` — no `TYPED_TEST`, no multi-type, never plain `TEST()`.

.github/agents/reviewer.agent.md

@@ -54,7 +54,7 @@ End with totals + verdict: APPROVE / REQUEST CHANGES.
 - [ ] SOLID: one concern per class, constructor injection, depend on abstractions, no duplicated logic.
 
 **Interfaces & errors (WARNING)**
-- [ ] `virtual ~I() = default` — never `= 0`. No exceptions — `std::optional`/status enums.
+- [ ] Interfaces: `protected:` non-virtual `~I() = default` — no `virtual` or `= 0` destructor, no ownership or deletion through an interface pointer. No exceptions — `std::optional`/status enums.
 
 **Testing (WARNING)**
 - [ ] `TEST_F` on `float` — no `TYPED_TEST`, no multi-type, never plain `TEST()`.

.github/copilot-instructions.md

@@ -9,5 +9,5 @@ Essentials (full detail in AGENTS.md):
 - **Embedded** — no `#pragma GCC optimize` / `optimize` attribute (they block inlining); the consumer sets optimization flags per TU; `OPTIMIZE_FOR_SPEED` (forced inlining) on hot paths.
 - **No comments** (except license/NOLINT). Allman braces, brace-init, PascalCase/camelCase.
 - **Tests** — `TEST_F` on `float`, `StrictMock` only, never plain `TEST()`, no redundant cases.
-- **No exceptions** — `std::optional`/status enums; interfaces `virtual ~I() = default`.
+- **No exceptions** — `std::optional`/status enums; interfaces get a `protected:` non-virtual `~I() = default`, never a virtual destructor.
 - **Be terse** — minimal prose; report file paths + pass/fail.

.github/instructions/numerical-cpp.instructions.md

@@ -68,7 +68,7 @@ Use `math::IsFinite` for finiteness checks: a consumer may still build with `-ff
 - SOLID principles — constructor injection, depend on abstractions
 - DRY — extract shared logic into helpers or templates
 - RAII for resource management
-- **No pure virtual destructors**: Never declare `virtual ~Interface() = 0`. Pure virtual destructors force the compiler to emit a thunk and a separate body, wasting memory on embedded targets. Use `virtual ~Interface() = default` if a virtual destructor is required, or omit it entirely when the class is never deleted through a base pointer.
+- **Protected, non-virtual interface destructors**: declare `~Interface() = default` in a `protected:` section, never `virtual ~Interface()` (defaulted or `= 0`). A virtual destructor puts a deleting destructor in every implementation's vtable, which links `operator delete` (and with it `malloc`/`free`) into heap-free firmware, and under multiple inheritance adds a thunk per base. The protected destructor makes deletion through an interface pointer a compile error. Concrete classes declare no destructor unless they need one, and callers hold the concrete type rather than a `std::unique_ptr` to the interface.
 - No virtual calls in ISR-callable or real-time critical paths
 
 ## Documentation — MANDATORY

AGENTS.md

@@ -44,7 +44,8 @@ resource-constrained embedded systems. Real-time, deterministic, no heap.
 
 ## Interfaces & errors
 
-- Interfaces = pure virtual classes; `virtual ~I() = default` — **never** `= 0` destructors.
+- Interfaces = pure virtual classes with a `protected:`, non-virtual `~I() = default` — **never** a `virtual` or `= 0` destructor. A virtual one puts a deleting destructor in every vtable, which links `operator delete`/`free` into heap-free firmware.
+- Concrete classes declare no destructor unless they need one. Never own or delete through an interface pointer (no `std::unique_ptr<I>`): hold the concrete type, pass `I&`.
 - No exceptions. Use `std::optional<T>` or status enums. `assert`/`really_assert` for preconditions.
 - SOLID + DIP: constructor injection; depend on abstractions. RAII. No virtual calls in real-time paths.
 

CLAUDE.md

@@ -9,5 +9,5 @@ Essentials (full detail in AGENTS.md):
 - **Embedded** — no `#pragma GCC optimize` / `optimize` attribute (they block inlining); the consumer sets optimization flags per TU; `OPTIMIZE_FOR_SPEED` (forced inlining) on hot paths.
 - **No comments** (except license/NOLINT). Allman braces, brace-init, PascalCase/camelCase.
 - **Tests** — `TEST_F` on `float`, `StrictMock` only, never plain `TEST()`, no redundant cases.
-- **No exceptions** — `std::optional`/status enums; interfaces `virtual ~I() = default`.
+- **No exceptions** — `std::optional`/status enums; interfaces get a `protected:` non-virtual `~I() = default`, never a virtual destructor.
 - **Be terse** — minimal prose; report file paths + pass/fail.

numerical/analysis/FastFourierTransform.hpp

@@ -9,8 +9,10 @@ namespace analysis
     class TwiddleFactors
     {
     public:
-        virtual ~TwiddleFactors() = default;
         virtual math::Complex<QNumberType>& operator[](std::size_t n) = 0;
+
+    protected:
+        ~TwiddleFactors() = default;
     };
 
     template<typename QNumberType>
@@ -21,8 +23,6 @@ namespace analysis
             "FastFourierTransform can only be instantiated with math::QNumber types.");
 
     public:
-        virtual ~FastFourierTransform() = default;
-
         static constexpr std::size_t Log2(std::size_t n)
         {
             std::size_t result = 0;
@@ -41,6 +41,8 @@ namespace analysis
         virtual VectorReal& Inverse(VectorComplex& input) = 0;
 
     protected:
+        ~FastFourierTransform() = default;
+
         template<typename T>
         inline T BitReverse(T x, T logr_n, T bits, T radix)
         {

numerical/analysis/windowing/Windowing.hpp

@@ -14,9 +14,11 @@ namespace windowing
             "Window can only be instantiated with math::QNumber types.");
 
     public:
-        virtual ~Window() = default;
         virtual QNumberType operator()(std::size_t n, std::size_t order) = 0;
         virtual QNumberType Power(std::size_t order) = 0;
+
+    protected:
+        ~Window() = default;
     };
 
     namespace detail

numerical/analysis/windowing/test/TestWindowing.cpp

@@ -11,7 +11,6 @@ namespace
     {
     protected:
         static constexpr float kEpsilon = 1e-3f;
-        std::unique_ptr<windowing::Window<QNumType>> window;
     };
 
     using WindowingTypes = ::testing::Types<math::Q31, math::Q15, float>;
@@ -20,7 +19,7 @@ namespace
 
 TYPED_TEST(WindowingTest, HammingWindowValues)
 {
-    this->window = std::make_unique<windowing::HammingWindow<TypeParam>>();
+    windowing::HammingWindow<TypeParam> window;
 
     struct TestCase
     {
@@ -36,7 +35,7 @@ TYPED_TEST(WindowingTest, HammingWindowValues)
 
     for (const auto& testCase : testCases)
     {
-        TypeParam result = (*this->window)(testCase.n, testCase.order);
+        TypeParam result = window(testCase.n, testCase.order);
         EXPECT_NEAR(math::ToFloat(result), testCase.expected, this->kEpsilon)
             << "Failed for n=" << testCase.n
             << ", order=" << testCase.order;
@@ -45,7 +44,7 @@ TYPED_TEST(WindowingTest, HammingWindowValues)
 
 TYPED_TEST(WindowingTest, HanningWindowValues)
 {
-    this->window = std::make_unique<windowing::HanningWindow<TypeParam>>();
+    windowing::HanningWindow<TypeParam> window;
 
     struct TestCase
     {
@@ -61,7 +60,7 @@ TYPED_TEST(WindowingTest, HanningWindowValues)
 
     for (const auto& testCase : testCases)
     {
-        TypeParam result = (*this->window)(testCase.n, testCase.order);
+        TypeParam result = window(testCase.n, testCase.order);
         EXPECT_NEAR(math::ToFloat(result), testCase.expected, this->kEpsilon)
             << "Failed for n=" << testCase.n
             << ", order=" << testCase.order;
@@ -70,7 +69,7 @@ TYPED_TEST(WindowingTest, HanningWindowValues)
 
 TYPED_TEST(WindowingTest, BlackmanWindowValues)
 {
-    this->window = std::make_unique<windowing::BlackmanWindow<TypeParam>>();
+    windowing::BlackmanWindow<TypeParam> window;
 
     struct TestCase
     {
@@ -85,7 +84,7 @@ TYPED_TEST(WindowingTest, BlackmanWindowValues)
 
     for (const auto& testCase : testCases)
     {
-        TypeParam result = (*this->window)(testCase.n, testCase.order);
+        TypeParam result = window(testCase.n, testCase.order);
         EXPECT_NEAR(math::ToFloat(result), testCase.expected, this->kEpsilon)
             << "Failed for n=" << testCase.n
             << ", order=" << testCase.order;
@@ -94,26 +93,26 @@ TYPED_TEST(WindowingTest, BlackmanWindowValues)
 
 TYPED_TEST(WindowingTest, RectangularWindowValues)
 {
-    this->window = std::make_unique<windowing::RectangularWindow<TypeParam>>();
+    windowing::RectangularWindow<TypeParam> window;
 
     for (std::size_t n = 0; n <= 8; n += 2)
     {
-        TypeParam result = (*this->window)(n, 8);
+        TypeParam result = window(n, 8);
         EXPECT_NEAR(math::ToFloat(result), 0.999f, this->kEpsilon)
             << "Failed for n=" << n;
     }
 }
 
 TYPED_TEST(WindowingTest, WindowSymmetry)
 {
-    std::vector<std::unique_ptr<windowing::Window<TypeParam>>> windows;
-    windows.push_back(std::make_unique<windowing::HammingWindow<TypeParam>>());
-    windows.push_back(std::make_unique<windowing::HanningWindow<TypeParam>>());
-    windows.push_back(std::make_unique<windowing::BlackmanWindow<TypeParam>>());
+    windowing::HammingWindow<TypeParam> hamming;
+    windowing::HanningWindow<TypeParam> hanning;
+    windowing::BlackmanWindow<TypeParam> blackman;
+    std::array<windowing::Window<TypeParam>*, 3> windows{ &hamming, &hanning, &blackman };
 
     const std::size_t order = 16;
 
-    for (const auto& window : windows)
+    for (auto* window : windows)
     {
         for (std::size_t n = 0; n < order / 2; ++n)
         {

numerical/controllers/implementations/Feedforward2Dof.hpp

@@ -12,9 +12,11 @@ namespace controllers
     public:
         static_assert(std::is_floating_point_v<T>, "Feedforward supports floating-point types");
 
-        virtual ~Feedforward() = default;
         virtual T Evaluate(T reference) = 0;
         virtual void Reset() = 0;
+
+    protected:
+        ~Feedforward() = default;
     };
 
     template<typename T>
@@ -23,9 +25,11 @@ namespace controllers
     public:
         static_assert(std::is_floating_point_v<T>, "FeedbackLaw supports floating-point types");
 
-        virtual ~FeedbackLaw() = default;
         virtual T Process(T error) = 0;
         virtual void Reset() = 0;
+
+    protected:
+        ~FeedbackLaw() = default;
     };
 
     template<typename T>