There is a complementary function quit-interface which calls the interface's confirm-destroy-function to confirm that the destroy should be done, and it is advisable to always use this unless you want to make sure that the interface's confirm-destroy-function is ignored.
destroy must only be called in the process of
. Menu callbacks on
will be called in that process, but otherwise you probably need to use execute-with-interface or apply-in-pane-process.
CAPI User Guide and Reference Manual (Macintosh version) - 3 Aug 2017