make ~Future() protected, not private