diff --git a/kernel/src/kernel/Frame_Policy/Frame_Scheduler.cpp b/kernel/src/kernel/Frame_Policy/Frame_Scheduler.cpp
index d4eab34..484f099 100644
--- a/kernel/src/kernel/Frame_Policy/Frame_Scheduler.cpp
+++ b/kernel/src/kernel/Frame_Policy/Frame_Scheduler.cpp
@@ -1,4 +1,5 @@
 #include "Frame_Scheduler.hpp"
+#include <ownership.hpp>
 #include <concurrentqueue-1.0.5/blockingconcurrentqueue.h>
 #include <timer-wheel.h>
 #include <algorithm>
@@ -37,7 +38,7 @@ Nanoseconds fps_period(double fps) {
 struct Frame_Scheduler::Timer::State {
     enum struct Mode : std::uint8_t { stopped, once, periodic };
 
-    Frame_Scheduler::Private* owner{};
+    not_null<Frame_Scheduler::Private*> owner;
     std::uint64_t id{};
     Handler handler{};
     std::atomic_bool alive{true};
@@ -46,7 +47,8 @@ struct Frame_Scheduler::Timer::State {
     Scheduler_Clock::time_point next_deadline{};    /* 真实 deadline，不按 tick 累积。 */
     TimerEvent<std::function<void()>> event;
 
-    State(Frame_Scheduler::Private* value_owner, std::uint64_t value_id,
+    State(not_null<Frame_Scheduler::Private*> value_owner,
+          std::uint64_t value_id,
           Handler value_handler);
 };
 
@@ -232,11 +234,11 @@ struct Frame_Scheduler::Private {
 };
 
 Frame_Scheduler::Timer::State::State(
-    Frame_Scheduler::Private* value_owner, std::uint64_t value_id,
+    not_null<Frame_Scheduler::Private*> value_owner, std::uint64_t value_id,
     Handler value_handler)
     : owner(value_owner), id(value_id), handler(std::move(value_handler)),
       event([this] {
-          if (owner) owner->fire(*this);
+          owner->fire(*this);
       }) {}
 
 Frame_Scheduler::Frame_Scheduler() : d(std::make_unique<Private>()) {}
@@ -257,8 +259,7 @@ Frame_Scheduler::Timer::Timer(std::shared_ptr<State> state) noexcept
 Frame_Scheduler::Timer::~Timer() noexcept {
     if (!state_) return;
     state_->alive.store(false, std::memory_order_release);
-    if (state_->owner)
-        state_->owner->enqueue({Private::Command_Type::destroy, state_, {}});
+    state_->owner->enqueue({Private::Command_Type::destroy, state_, {}});
 }
 
 Frame_Scheduler::Timer::Timer(Timer&& other) noexcept
diff --git a/kernel/src/kernel/Task_Graph.cpp b/kernel/src/kernel/Task_Graph.cpp
index eeca8ae..644260f 100644
--- a/kernel/src/kernel/Task_Graph.cpp
+++ b/kernel/src/kernel/Task_Graph.cpp
@@ -79,9 +79,10 @@ struct Task_Graph::Private {
         }
     }
 
-    void bind_frame(Render_Frame* frame) noexcept {
+    void bind_frame(
+        std::optional<not_null<Render_Frame*>> frame) noexcept {
         for (auto& node : nodes) {
-            node.task.data(frame);
+            node.task.data(frame ? frame->get() : nullptr);
             if (node.child) node.child->bind_frame(frame);
         }
     }
@@ -106,7 +107,7 @@ std::vector<Taskflow_Graph_Trace::Node> Task_Graph_Access::nodes(
 }
 
 void Task_Graph_Access::bind_frame(Task_Graph& graph,
-                                   Render_Frame* frame) noexcept {
+    std::optional<not_null<Render_Frame*>> frame) noexcept {
     graph.d->bind_frame(frame);
 }
 }
diff --git a/kernel/src/kernel/Task_Graph_Internal.hpp b/kernel/src/kernel/Task_Graph_Internal.hpp
index 5035554..c1afaca 100644
--- a/kernel/src/kernel/Task_Graph_Internal.hpp
+++ b/kernel/src/kernel/Task_Graph_Internal.hpp
@@ -1,8 +1,10 @@
 #pragma once
 #include "Task_Graph.hpp"
 #include "frame.hpp"
+#include "ownership.hpp"
 #include <cstdint>
 #include <memory>
+#include <optional>
 #include <string>
 #include <string_view>
 
@@ -12,7 +14,9 @@ struct Task_Graph_Access {
     [[nodiscard]] static void* native_storage(Task_Graph& graph) noexcept;
     [[nodiscard]] static std::vector<Taskflow_Graph_Trace::Node> nodes(
         const Task_Graph& graph);
-    static void bind_frame(Task_Graph& graph, Render_Frame* frame) noexcept;
+    static void bind_frame(
+        Task_Graph& graph,
+        std::optional<not_null<Render_Frame*>> frame) noexcept;
 };
 /* Task_Graph.cpp 到全局 Kernel Executor 的内部桥；不得在模块公共头文件中声明。 */
 void corun_taskflow_until(std::function<bool()> predicate);
diff --git a/kernel/src/kernel/Taskflow_Frame_Access.hpp b/kernel/src/kernel/Taskflow_Frame_Access.hpp
index b83b48f..e94b6d2 100644
--- a/kernel/src/kernel/Taskflow_Frame_Access.hpp
+++ b/kernel/src/kernel/Taskflow_Frame_Access.hpp
@@ -1,12 +1,13 @@
 #pragma once
 #include "frame.hpp"
 #include "Task_Graph.hpp"
+#include "ownership.hpp"
 #include <chrono>
 #include <string_view>
 
 namespace aethera::detail {
 struct Taskflow_Graph_Token {
-    Render_Frame* frame{};                                  /* DAG 运行记录所属外部帧；帧完成前有效。 */
+    not_null<Render_Frame*> frame;                           /* DAG 运行记录所属外部帧；帧完成前有效。 */
     std::size_t index{};                                    /* 帧内 graph 记录索引。 */
 };
 struct Taskflow_Graph_Timing {
diff --git a/kernel/src/kernel/double_buffer/Dependency_Graph.hpp b/kernel/src/kernel/double_buffer/Dependency_Graph.hpp
index 5527ab6..ea232aa 100644
--- a/kernel/src/kernel/double_buffer/Dependency_Graph.hpp
+++ b/kernel/src/kernel/double_buffer/Dependency_Graph.hpp
@@ -6,16 +6,16 @@ struct Dependency_Graph {
     using Error = Dependency_Graph_Error;
     struct Node {
         using Bind = void (*)(Node*, Root*);
-        Root* object;
-        std::pmr::vector<Node*> dependencies;
+        aethera::not_null<Root*> object;
+        std::pmr::vector<aethera::not_null<Node*>> dependencies;
         Bind bind;
         void* data{};
         Node(Root* value, std::pmr::memory_resource* resource) : Node(value, resource, nullptr) {}
         Node(Root* value, std::pmr::memory_resource* resource, Bind value_bind) : object(value), dependencies(resource), bind(value_bind) {}
     };
     struct Edge {
-        Root* target;
-        Root* source;
+        aethera::not_null<Root*> target;
+        aethera::not_null<Root*> source;
         const void* source_key;
         const void* target_tag;
         const void* target_dirty_key;
@@ -23,26 +23,26 @@ struct Dependency_Graph {
     };
 private:
     struct Dirty_Source {
-        Root* object;
+        aethera::not_null<Root*> object;
         const void* key;
         bool operator==(const Dirty_Source&) const = default;
     };
     struct Dirty_Source_Hash {
         std::size_t operator()(const Dirty_Source& value) const {
-            auto object = std::hash<Root*>{}(value.object);
+            auto object = std::hash<Root*>{}(value.object.get());
             auto key = std::hash<const void*>{}(value.key);
             return object ^ (key + 0x9e3779b9 + (object << 6) + (object >> 2));
         }
     };
     struct Dirty_Target {
-        Root* object;
+        aethera::not_null<Root*> object;
         const void* tag;
         const void* dirty_key;
     };
 public:
     struct View {
     protected:
-        const Dependency_Graph* dependency_graph;
+        aethera::not_null<const Dependency_Graph*> dependency_graph;
         explicit View(const Dependency_Graph& value) : dependency_graph(&value) {}
         friend struct Dependency_Graph;
     public:
@@ -86,7 +86,7 @@ public:
         }
         [[nodiscard]] Object* object(const Node& node) const {
             if (!bound(node)) return nullptr;
-            return static_cast<Object*>(node.object);
+            return static_cast<Object*>(node.object.get());
         }
         [[nodiscard]] Private_Type* private_data(const Node& node) const noexcept {
             return static_cast<Private_Type*>(node.data);
@@ -100,7 +100,8 @@ public:
             this->dependency_graph->for_each(
                 [&](const Node& node) {
                     auto* data = private_data(node);
-                    if (data) std::invoke(callback, static_cast<Object*>(node.object), *data);
+                    if (data) std::invoke(
+                        callback, static_cast<Object*>(node.object.get()), *data);
                 }
             );
         }
@@ -121,7 +122,7 @@ public:
     template <Root_Derived Bound_Object>
     struct Editor : public View {
     private:
-        Dependency_Graph* edit_dependency_graph;
+        aethera::not_null<Dependency_Graph*> edit_dependency_graph;
         const void* target_tag;
         const void* target_dirty_key;
         bool bind_node_data;
@@ -254,23 +255,23 @@ private:
     friend struct detail::Dependency_Graph_Storage;
     template <typename Tuple>
     friend struct detail::Dependency_Graph_Build_Storage;
-    std::pmr::memory_resource* pmr_resource;
+    aethera::not_null<std::pmr::memory_resource*> pmr_resource;
     std::pmr::list<Node> list;
-    std::pmr::unordered_map<Root*, Node*> nodes;
+    std::pmr::unordered_map<Root*, aethera::not_null<Node*>> nodes;
     std::pmr::vector<Edge> edges;
     std::pmr::unordered_multimap<Dirty_Source, Dirty_Target, Dirty_Source_Hash> dirty_edges;
     std::uint64_t structure_revision{};
     mutable bool bound{};
-    Dependency_Graph* mirror{};
+    std::optional<aethera::not_null<Dependency_Graph*>> mirror{};
     Node* emplace_node(Root* object, Node::Bind bind) {
         auto current = nodes.find(object);
         if (current != nodes.end()) {
             current->second->bind = bind;
-            return current->second;
+            return current->second.get();
         }
-        list.emplace_back(object, pmr_resource, bind);
+        list.emplace_back(object, pmr_resource.get(), bind);
         auto* result = &list.back();
-        nodes.emplace(object, result);
+        nodes.emplace(object, aethera::not_null{result});
         return result;
     }
     static bool contains_node_dependency(Node* node, Node* dependency) {
@@ -284,17 +285,17 @@ private:
             edges.begin(),
             edges.end(),
             [&](const Edge& edge) {
-                return edge.target == target && edge.source == source;
+                return edge.target.get() == target && edge.source.get() == source;
             }
         ) != edges.end();
     }
     void rebuild_node_dependencies() {
         for (auto& node : list) node.dependencies.clear();
         for (const auto& edge : edges) {
-            auto target = nodes.find(edge.target);
-            auto source = nodes.find(edge.source);
+            auto target = nodes.find(edge.target.get());
+            auto source = nodes.find(edge.source.get());
             if (target == nodes.end() || source == nodes.end()) continue;
-            add_node_dependency(target->second, source->second);
+            add_node_dependency(target->second.get(), source->second.get());
         }
     }
     void rebuild_dirty_edges() {
@@ -326,7 +327,8 @@ private:
         const void* source_key,
         const void* target_tag,
         const void* target_dirty_key) {
-        Edge edge{target->object, source->object, source_key, target_tag, target_dirty_key};
+        Edge edge{target->object, source->object, source_key, target_tag,
+                  target_dirty_key};
         if (std::find(edges.begin(), edges.end(), edge) != edges.end()) return;
         edges.push_back(edge);
         ++structure_revision;
@@ -349,7 +351,7 @@ private:
     }
     void bind_nodes() {
         for (auto& node : list) {
-            if (node.bind) node.bind(&node, node.object);
+            if (node.bind) node.bind(&node, node.object.get());
         }
     }
     template <Root_Derived Bound_Object, Root_Derived Object>
@@ -358,8 +360,8 @@ private:
         auto current = nodes.find(object);
         if (current != nodes.end()) {
             current->second->bind = bind;
-            if (bind_node && bind) bind(current->second, object);
-            return current->second;
+            if (bind_node && bind) bind(current->second.get(), object);
+            return current->second.get();
         }
         auto* node = emplace_node(object, bind);
         if (bind_node && bind) bind(node, object);
@@ -378,7 +380,7 @@ private:
     }
     void detach_destroyed(Root* object) {
         remove_node(object);
-        if (mirror) mirror->remove_node(object);
+        if (mirror) (*mirror)->remove_node(object);
     }
     void reset() {
         if (list.empty() && edges.empty()) return;
@@ -386,7 +388,8 @@ private:
         ++structure_revision;
     }
     void copy_from(const Dependency_Graph& other) {
-        for (const auto& node : other.list) emplace_node(node.object, node.bind)->data = node.data;
+        for (const auto& node : other.list)
+            emplace_node(node.object.get(), node.bind)->data = node.data;
         edges = other.edges;
         structure_revision = other.structure_revision;
         rebuild();
@@ -416,8 +419,8 @@ private:
         std::erase_if(
             edges,
             [&](const Edge& edge) {
-                return edge.target == target &&
-                edge.source == source &&
+                return edge.target.get() == target &&
+                edge.source.get() == source &&
                 edge.source_key == source_key &&
                 edge.target_tag == target_tag;
             }
@@ -430,11 +433,11 @@ private:
     bool remove_node(Root* object) {
         auto current = nodes.find(object);
         if (current == nodes.end()) return false;
-        Node* node = current->second;
+        Node* node = current->second.get();
         std::erase_if(
             edges,
             [&](const Edge& edge) {
-                return edge.target == object || edge.source == object;
+                return edge.target.get() == object || edge.source.get() == object;
             }
         );
         nodes.erase(current);
@@ -451,7 +454,7 @@ private:
     void clear_dependencies_impl(Root* target) {
         auto old_size = edges.size();
         std::erase_if(edges, [&](const Edge& edge) {
-            return edge.target == target;
+            return edge.target.get() == target;
         });
         if (old_size == edges.size()) return;
         ++structure_revision;
@@ -460,7 +463,7 @@ private:
     void remove_dependents_impl(Root* source) {
         auto old_size = edges.size();
         std::erase_if(edges, [&](const Edge& edge) {
-            return edge.source == source;
+            return edge.source.get() == source;
         });
         if (old_size == edges.size()) return;
         ++structure_revision;
@@ -471,7 +474,7 @@ private:
         std::erase_if(
             edges,
             [&](const Edge& edge) {
-                return edge.target == object || edge.source == object;
+                return edge.target.get() == object || edge.source.get() == object;
             }
         );
         if (old_size == edges.size()) return;
@@ -483,7 +486,7 @@ private:
         std::erase_if(
             edges,
             [&](const Edge& edge) {
-                return edge.target == target && edge.source == source;
+                return edge.target.get() == target && edge.source.get() == source;
             }
         );
         if (old_size == edges.size()) return false;
@@ -503,7 +506,8 @@ public:
                                                                      nodes(resource),
                                                                      edges(resource),
                                                                      dirty_edges(resource) {}
-    Dependency_Graph(const Dependency_Graph& other) : Dependency_Graph(other.pmr_resource) {
+    Dependency_Graph(const Dependency_Graph& other)
+        : Dependency_Graph(other.pmr_resource.get()) {
         copy_from(other);
     }
     Dependency_Graph& operator=(const Dependency_Graph& other) {
@@ -527,8 +531,8 @@ public:
             swap_data(other);
         }
         else {
-            Dependency_Graph this_value(*this, other.pmr_resource);
-            Dependency_Graph other_value(other, pmr_resource);
+            Dependency_Graph this_value(*this, other.pmr_resource.get());
+            Dependency_Graph other_value(other, pmr_resource.get());
             clear_data();
             other.clear_data();
             copy_from(other_value);
@@ -539,12 +543,14 @@ public:
     }
     void bind() const {
         if (bound) return;
-        for (const auto& node : list) node.object->bind_dependency_graph(this);
+        for (const auto& node : list)
+            node.object->bind_dependency_graph(aethera::not_null{this});
         bound = true;
     }
     void unbind() const {
         if (!bound) return;
-        for (const auto& node : list) node.object->unbind_dependency_graph(this);
+        for (const auto& node : list)
+            node.object->unbind_dependency_graph(aethera::not_null{this});
         bound = false;
     }
     bool empty() const {
@@ -554,17 +560,17 @@ public:
         return list.size();
     }
     std::pmr::memory_resource* memory_resource() const noexcept {
-        return pmr_resource;
+        return pmr_resource.get();
     }
     Node* find(Root* object) {
         auto current = nodes.find(object);
         if (current == nodes.end()) return nullptr;
-        return current->second;
+        return current->second.get();
     }
     const Node* find(Root* object) const {
         auto current = nodes.find(object);
         if (current == nodes.end()) return nullptr;
-        return current->second;
+        return current->second.get();
     }
     bool contains(Root* object) const {
         return nodes.contains(object);
@@ -575,14 +581,14 @@ public:
     std::vector<Node*> dependents(Root* source) {
         std::vector<Node*> result;
         for (auto& node : list) {
-            if (depends_on(node.object, source)) result.push_back(&node);
+            if (depends_on(node.object.get(), source)) result.push_back(&node);
         }
         return result;
     }
     std::vector<const Node*> dependents(Root* source) const {
         std::vector<const Node*> result;
         for (const auto& node : list) {
-            if (depends_on(node.object, source)) result.push_back(&node);
+            if (depends_on(node.object.get(), source)) result.push_back(&node);
         }
         return result;
     }
@@ -590,13 +596,14 @@ public:
         std::vector<const Node*> result;
         const auto& values = nodes.at(object)->dependencies;
         result.reserve(values.size());
-        for (const auto* dependency : values) result.push_back(dependency);
+        for (const auto dependency : values) result.push_back(dependency.get());
         return result;
     }
     std::vector<Edge> find_edges(Root* target, Root* source) const {
         std::vector<Edge> result;
         for (const auto& edge : edges) {
-            if (edge.target == target && edge.source == source) result.push_back(edge);
+            if (edge.target.get() == target && edge.source.get() == source)
+                result.push_back(edge);
         }
         return result;
     }
@@ -611,7 +618,7 @@ public:
             visiting,
             visited
         };
-        std::pmr::unordered_map<const Node*, Visit> visits{pmr_resource};
+        std::pmr::unordered_map<const Node*, Visit> visits{pmr_resource.get()};
         std::vector<const Node*> result;
         result.reserve(list.size());
         for (const auto& node : list) visits.emplace(&node, Visit::none);
@@ -621,12 +628,13 @@ public:
             if (current->second == Visit::visited) return {};
             if (current->second == Visit::visiting) return std::unexpected(Error::cycle);
             current->second = Visit::visiting;
-            for (const auto* dependency : node->dependencies) {
-                if (dependency == node) return std::unexpected(Error::self_dependency);
-                auto dependency_state = visits.find(dependency);
+            for (const auto dependency : node->dependencies) {
+                if (dependency.get() == node)
+                    return std::unexpected(Error::self_dependency);
+                auto dependency_state = visits.find(dependency.get());
                 if (dependency_state == visits.end()) return std::unexpected(Error::missing_dependency);
                 if (dependency_state->second == Visit::visiting) return std::unexpected(Error::cycle);
-                auto check = self(self, dependency);
+                auto check = self(self, dependency.get());
                 if (!check) return std::unexpected(check.error());
             }
             current->second = Visit::visited;
@@ -673,9 +681,9 @@ public:
 };
 inline Root::~Root() {
     while (!dependency_graphs.empty()) {
-        auto* dependency_graph = dependency_graphs.back();
+        const auto dependency_graph = dependency_graphs.back();
         dependency_graphs.pop_back();
-        const_cast<Dependency_Graph*>(dependency_graph)->detach_destroyed(this);
+        const_cast<Dependency_Graph*>(dependency_graph.get())->detach_destroyed(this);
     }
     delete d;
 }
diff --git a/kernel/src/kernel/double_buffer/Dependency_Graph_Storage.hpp b/kernel/src/kernel/double_buffer/Dependency_Graph_Storage.hpp
index 1d1b8ea..7d056c9 100644
--- a/kernel/src/kernel/double_buffer/Dependency_Graph_Storage.hpp
+++ b/kernel/src/kernel/double_buffer/Dependency_Graph_Storage.hpp
@@ -17,11 +17,13 @@ concept Dependency_Graph_Access_Callback_For = Dependency_Graph_List<Tuple> && U
 inline bool Root::mark_dirty_id(const void* tag, const void* dirty_key) {
     if (std::find(dirty_tags.begin(), dirty_tags.end(), tag) != dirty_tags.end()) return false;
     dirty_tags.push_back(tag);
-    for (const auto* dependency_graph : dependency_graphs) dependency_graph->emit(this, dirty_key);
+    for (const auto dependency_graph : dependency_graphs)
+        dependency_graph->emit(this, dirty_key);
     return true;
 }
 inline void Root::emit_dependency(const void* key) {
-    for (const auto* dependency_graph : dependency_graphs) dependency_graph->emit(this, key);
+    for (const auto dependency_graph : dependency_graphs)
+        dependency_graph->emit(this, key);
 }
 namespace detail {
 template <typename Tuple>
diff --git a/kernel/src/kernel/double_buffer/Mpmc_Triple_Buffer.hpp b/kernel/src/kernel/double_buffer/Mpmc_Triple_Buffer.hpp
index 4a752a8..3245361 100644
--- a/kernel/src/kernel/double_buffer/Mpmc_Triple_Buffer.hpp
+++ b/kernel/src/kernel/double_buffer/Mpmc_Triple_Buffer.hpp
@@ -1,4 +1,5 @@
 #pragma once
+#include <ownership.hpp>
 #include <concepts>
 #include <algorithm>
 #include <concurrentqueue-1.0.5/concurrentqueue.h>
@@ -38,7 +39,7 @@ public:
     }
     void advance() {
         std::unique_lock lock(exchange_lock_);
-        auto* expired_query = query_;
+        const auto expired_query = query_;
         query_ = rendering_;
         rendering_ = collecting_;
         collecting_ = expired_query;
@@ -123,9 +124,9 @@ private:
     mutable Queue first_{}; /* First physical MPMC queue; role changes only under exchange_lock_. */
     mutable Queue second_{}; /* Second physical MPMC queue; role changes only under exchange_lock_. */
     mutable Queue third_{}; /* Third physical MPMC queue; role changes only under exchange_lock_. */
-    Queue* collecting_{&first_}; /* Concurrent producer destination until the next exchange. */
-    Queue* rendering_{&second_}; /* Immutable-to-producers queue consumed by the renderer. */
-    mutable Queue* query_{&third_}; /* Last completed render input exposed to observers. */
+    aethera::not_null<Queue*> collecting_{&first_}; /* Concurrent producer destination until the next exchange. */
+    aethera::not_null<Queue*> rendering_{&second_}; /* Immutable-to-producers queue consumed by the renderer. */
+    mutable aethera::not_null<Queue*> query_{&third_}; /* Last completed render input exposed to observers. */
 };
 template <typename Tuple>
 struct Mpmc_Triple_Buffer_Storage_Set;
diff --git a/kernel/src/kernel/double_buffer/mechanism.hpp b/kernel/src/kernel/double_buffer/mechanism.hpp
index 765ed20..d97e4e0 100644
--- a/kernel/src/kernel/double_buffer/mechanism.hpp
+++ b/kernel/src/kernel/double_buffer/mechanism.hpp
@@ -1,5 +1,6 @@
 #pragma once
 #include "Mpmc_Triple_Buffer.hpp"
+#include <ownership.hpp>
 #include <algorithm>
 #include <atomic>
 #include <cstddef>
@@ -30,17 +31,17 @@ concept Prop_State = std::default_initializable<Value> && std::assignable_from<V
 struct Pmr {
     using Resource = std::pmr::memory_resource;
 private:
-    Resource* value;
+    aethera::not_null<Resource*> value;
 public:
     Pmr() noexcept : value(std::pmr::get_default_resource()) {}
     explicit Pmr(Resource& resource) noexcept : value(&resource) {}
     explicit Pmr(Resource* resource) noexcept : value(resource ? resource : std::pmr::get_default_resource()) {}
     [[nodiscard]] Resource* resource() const noexcept {
-        return value;
+        return value.get();
     }
     template <typename Value>
     std::pmr::polymorphic_allocator<Value> allocator() const noexcept {
-        return std::pmr::polymorphic_allocator<Value>{value};
+        return std::pmr::polymorphic_allocator<Value>{value.get()};
     }
     static Resource* default_resource() noexcept {
         return std::pmr::get_default_resource();
@@ -57,18 +58,19 @@ struct Pmr_Resource : public std::pmr::memory_resource {
 private:
     using Resource = std::pmr::memory_resource;
     struct Header {
-        Resource* resource;
-        void* base;
+        aethera::not_null<Resource*> resource;
+        aethera::not_null<void*> base;
         std::size_t bytes;
         std::size_t alignment;
     };
-    Resource* upstream;
+    aethera::not_null<Resource*> upstream;
     void* do_allocate(std::size_t bytes, std::size_t alignment) override {
         auto effective_alignment = std::max(alignment, alignof(Header));
         auto total = bytes + sizeof(Header) + effective_alignment - 1;
-        auto* resource = upstream;
-        void* base = resource->allocate(total, effective_alignment);
-        auto begin = reinterpret_cast<std::uintptr_t>(base) + sizeof(Header);
+        const auto resource = upstream;
+        const aethera::not_null<void*> base{
+            resource->allocate(total, effective_alignment)};
+        auto begin = reinterpret_cast<std::uintptr_t>(base.get()) + sizeof(Header);
         auto aligned = (begin + effective_alignment - 1) & ~(static_cast<std::uintptr_t>(effective_alignment) - 1);
         auto* header = reinterpret_cast<Header*>(aligned - sizeof(Header));
         std::construct_at(header, Header{resource, base, total, effective_alignment});
@@ -76,12 +78,12 @@ private:
     }
     void do_deallocate(void* pointer, std::size_t, std::size_t) override {
         auto* header = reinterpret_cast<Header*>(reinterpret_cast<std::uintptr_t>(pointer) - sizeof(Header));
-        auto* resource = header->resource;
-        void* base = header->base;
+        const auto resource = header->resource;
+        const auto base = header->base;
         auto bytes = header->bytes;
         auto alignment = header->alignment;
         std::destroy_at(header);
-        resource->deallocate(base, bytes, alignment);
+        resource->deallocate(base.get(), bytes, alignment);
     }
     bool do_is_equal(const std::pmr::memory_resource& other) const noexcept override {
         return this == &other;
@@ -93,7 +95,7 @@ public:
         upstream = resource ? resource : std::pmr::get_default_resource();
     }
     Resource* resource() const noexcept {
-        return upstream;
+        return upstream.get();
     }
 };
 }
@@ -111,8 +113,8 @@ struct Double_Buffer : Pinned {
 private:
     std::tuple<Value, Value> buf;
 public:
-    Value* pending;
-    Value* current;
+    aethera::not_null<Value*> pending;
+    aethera::not_null<Value*> current;
     Double_Buffer() : Double_Buffer(std::allocator_arg, allocator_type{std::pmr::get_default_resource()}) {}
     Double_Buffer(std::allocator_arg_t, const allocator_type& allocator) : buf(std::allocator_arg, allocator),
                                                                            pending(&std::get < 0 > (buf)),
@@ -601,7 +603,7 @@ template <typename State_Type> requires detail::State_Chain<std::remove_const_t<
 struct State_Access {
 private:
     using Value_Type = std::remove_const_t<State_Type>;
-    State_Type* state;
+    aethera::not_null<State_Type*> state;
     template <typename Other_State_Type> requires detail::State_Chain<std::remove_const_t<Other_State_Type>>
     friend struct State_Access;
 public:
@@ -622,7 +624,7 @@ template <typename Prop_Type> requires detail::Prop_Chain<std::remove_const_t<Pr
 struct Prop_Access {
 private:
     using Value_Type = std::remove_const_t<Prop_Type>;
-    Prop_Type* prop;
+    aethera::not_null<Prop_Type*> prop;
     template <typename Other_Prop_Type> requires detail::Prop_Chain<std::remove_const_t<Other_Prop_Type>>
     friend struct Prop_Access;
 public:
@@ -642,7 +644,7 @@ Prop_Access(Prop_Type&) -> Prop_Access<Prop_Type>;
 template <typename Private_Type>
 struct Private_Access {
 private:
-    Private_Type* private_data;
+    aethera::not_null<Private_Type*> private_data;
     template <typename Other_Private_Type>
     friend struct Private_Access;
 public:
@@ -752,20 +754,22 @@ private:
     using Call = void (*)(Root*);
     Call advance_call{};
     detail::Pmr_Resource pmr_resource;
-    std::pmr::vector<const Dependency_Graph*> dependency_graphs;
+    std::pmr::vector<aethera::not_null<const Dependency_Graph*>> dependency_graphs;
     std::pmr::vector<const void*> dirty_tags;
 protected:
-    Private* d{}; /* Builder::build() 挂接的最终 Private；由 Root 析构释放。 */
+    aethera::owner<Private*> d{}; /* Builder::build() 挂接的最终 Private；由 Root 析构释放。 */
 private:
     void set_pmr_resource(Pmr pmr) noexcept {
         pmr_resource.set_resource(pmr.resource());
     }
     bool mark_dirty_id(const void* tag, const void* dirty_key);
     void emit_dependency(const void* key);
-    void bind_dependency_graph(const Dependency_Graph* dependency_graph) {
+    void bind_dependency_graph(
+        aethera::not_null<const Dependency_Graph*> dependency_graph) {
         if (std::find(dependency_graphs.begin(), dependency_graphs.end(), dependency_graph) == dependency_graphs.end()) dependency_graphs.push_back(dependency_graph);
     }
-    void unbind_dependency_graph(const Dependency_Graph* dependency_graph) {
+    void unbind_dependency_graph(
+        aethera::not_null<const Dependency_Graph*> dependency_graph) {
         std::erase(dependency_graphs, dependency_graph);
     }
     friend struct Dependency_Graph;
diff --git a/kernel/src/kernel/double_buffer/model.hpp b/kernel/src/kernel/double_buffer/model.hpp
index 2e4724d..cc98bf1 100644
--- a/kernel/src/kernel/double_buffer/model.hpp
+++ b/kernel/src/kernel/double_buffer/model.hpp
@@ -215,35 +215,35 @@ private:
     }
 public:
     [[nodiscard]] typename Base::Axis_Range_Type runtime_coordinate_range() const override {
-        return static_cast<const Base&>(*this).coordinate_range(runtime().object);
+        return static_cast<const Base&>(*this).coordinate_range(runtime().object.get());
     }
     [[nodiscard]] typename Base::Axis_Pixel_Position_Type runtime_coordinate_to_pixel(
         typename Base::Axis_Coordinate_Type coordinate) const override {
-        return static_cast<const Base&>(*this).coordinate_to_pixel(runtime().object, coordinate);
+        return static_cast<const Base&>(*this).coordinate_to_pixel(runtime().object.get(), coordinate);
     }
     [[nodiscard]] typename Base::Axis_Coordinate_Type runtime_pixel_to_coordinate(
         typename Base::Axis_Pixel_Position_Type pixel) const override {
-        return static_cast<const Base&>(*this).pixel_to_coordinate(runtime().object, pixel);
+        return static_cast<const Base&>(*this).pixel_to_coordinate(runtime().object.get(), pixel);
     }
     [[nodiscard]] typename Base::Axis_Coordinate_Type runtime_point_to_coordinate(
         typename Base::Axis_Point_Type point) const override {
-        return static_cast<const Base&>(*this).point_to_coordinate(runtime().object, point);
+        return static_cast<const Base&>(*this).point_to_coordinate(runtime().object.get(), point);
     }
     [[nodiscard]] typename Base::Axis_Pixel_Sample_Count_Type runtime_pixel_sample_count(
         typename Base::Axis_Range_Type coordinate_range) const override {
-        return static_cast<const Base&>(*this).pixel_sample_count(runtime().object, coordinate_range);
+        return static_cast<const Base&>(*this).pixel_sample_count(runtime().object.get(), coordinate_range);
     }
     [[nodiscard]] typename Base::Axis_Coordinate_Type runtime_tick_step(
         typename Base::Axis_Range_Type coordinate_range) const override {
-        return static_cast<const Base&>(*this).tick_step(runtime().object, coordinate_range);
+        return static_cast<const Base&>(*this).tick_step(runtime().object.get(), coordinate_range);
     }
     [[nodiscard]] std::string runtime_tick_label(
         typename Base::Axis_Coordinate_Type tick) const override {
-        return static_cast<const Base&>(*this).tick_label(runtime().object, tick);
+        return static_cast<const Base&>(*this).tick_label(runtime().object.get(), tick);
     }
     [[nodiscard]] typename Base::Axis_Tick_Count_Type runtime_sub_tick_count(
         typename Base::Axis_Coordinate_Type major_step) const override {
-        return static_cast<const Base&>(*this).sub_tick_count(runtime().object, major_step);
+        return static_cast<const Base&>(*this).sub_tick_count(runtime().object.get(), major_step);
     }
 };
 
@@ -263,15 +263,15 @@ private:
     }
 public:
     [[nodiscard]] std::size_t runtime_time_point_count() const override {
-        return static_cast<const Base&>(*this).time_point_count(runtime().object);
+        return static_cast<const Base&>(*this).time_point_count(runtime().object.get());
     }
     typename Base::Axis_Time_Tick_Type runtime_append_time(
         typename Base::Time_Of_Day_Type time) override {
-        return static_cast<Base&>(*this).append_time(runtime().object, time);
+        return static_cast<Base&>(*this).append_time(runtime().object.get(), time);
     }
     [[nodiscard]] typename Base::Time_Of_Day_Type runtime_tick_to_time(
         typename Base::Axis_Time_Tick_Type tick) const override {
-        return static_cast<const Base&>(*this).tick_to_time(runtime().object, tick);
+        return static_cast<const Base&>(*this).tick_to_time(runtime().object.get(), tick);
     }
 };
 
@@ -287,7 +287,7 @@ struct Attached_Private : Runtime_Private_Base<Obj, Lock>, Commit_Double_Buffer<
     using States = typename Obj::States;
     /* CRTP 最终 Builder：所有基类流式接口都返回本类型，确保 build() 分派到最派生业务 Builder。 */
     using Private = Attached_Private;
-    Obj* object;
+    aethera::not_null<Obj*> object;
         using Allocator = std::pmr::polymorphic_allocator<std::byte>;
         mutable Lock advance_lock;                                      /* 仅保护全部双缓冲在 advance/publish 边界的交换。 */
         Commit_Double_Buffer<typename Obj::State> state;
@@ -345,14 +345,18 @@ private:
     template <typename Owner, typename Member>
     void before_prop_set(Member Owner::* member) {
         Prop_Access props{*data().pending};
-        auto callback = [&](auto& private_data) { private_data.before_prop_set(object, member, props); };
-        Obj::template walk_private<false, Obj>(object, callback);
+        auto callback = [&](auto& private_data) {
+            private_data.before_prop_set(object.get(), member, props);
+        };
+        Obj::template walk_private<false, Obj>(object.get(), callback);
     }
     template <typename Owner, typename Member>
     void after_prop_set(Member Owner::* member) {
         Prop_Access props{*data().pending};
-        auto callback = [&](auto& private_data) { private_data.after_prop_set(object, member, props); };
-        Obj::template walk_private<true, Obj>(object, callback);
+        auto callback = [&](auto& private_data) {
+            private_data.after_prop_set(object.get(), member, props);
+        };
+        Obj::template walk_private<true, Obj>(object.get(), callback);
     }
     template <auto Member>
     void emit_prop_dependencies() {
@@ -364,17 +368,17 @@ private:
     void before_state_set(Member Owner::* member) {
         State_Access pending_states{*data().state.pending};
         auto callback = [&](auto& private_data) {
-            private_data.before_state_set(object, member, pending_states);
+            private_data.before_state_set(object.get(), member, pending_states);
         };
-        Obj::template walk_private<false, Obj>(object, callback);
+        Obj::template walk_private<false, Obj>(object.get(), callback);
     }
     template <typename Owner, typename Member>
     void after_state_set(Member Owner::* member) {
         State_Access pending_states{*data().state.pending};
         auto callback = [&](auto& private_data) {
-            private_data.after_state_set(object, member, pending_states);
+            private_data.after_state_set(object.get(), member, pending_states);
         };
-        Obj::template walk_private<true, Obj>(object, callback);
+        Obj::template walk_private<true, Obj>(object.get(), callback);
     }
     /* 同时发布字段级键和字段所属 State Tag 的状态层级键。 */
     template <auto Member>
@@ -388,28 +392,28 @@ private:
         State_Access current_states{std::as_const(*data().state.current)};
         auto callback = [&](auto& private_data) {
             private_data.before_advance(
-                object,
-                data().pending,
+                object.get(),
+                data().pending.get(),
                 pending_states,
-                data().current,
+                data().current.get(),
                 current_states
             );
         };
-        Obj::template walk_private<false, Obj>(object, callback);
+        Obj::template walk_private<false, Obj>(object.get(), callback);
     }
     void after_advance() {
         State_Access pending_states{*data().state.pending};
         State_Access current_states{*data().state.current};
         auto callback = [&](auto& private_data) {
             private_data.after_advance(
-                object,
-                data().pending,
+                object.get(),
+                data().pending.get(),
                 pending_states,
-                data().current,
+                data().current.get(),
                 current_states
             );
         };
-        Obj::template walk_private<true, Obj>(object, callback);
+        Obj::template walk_private<true, Obj>(object.get(), callback);
     }
     void exchange() {
         // Prop 与 State 均从外部 pending 提交到内部 current，交换后 pending 同步为最新编辑基线。
@@ -465,13 +469,15 @@ public:
     template <detail::Dependency_Graph_Tag_In<Dependency_Graph_Types> Tag>
     [[nodiscard]] auto pending_dependency_graph() const {
         using Bound_Object = detail::Dependency_Graph_Bound_Object<Tag, Dependency_Graph_Types>;
-        const Dependency_Graph* graph = data().dependency_graph_storage.template get<Tag>().pending;
+        const auto graph =
+            data().dependency_graph_storage.template get<Tag>().pending;
         return graph->typed_view<Bound_Object>();
     }
     template <detail::Dependency_Graph_Tag_In<Dependency_Graph_Types> Tag>
     [[nodiscard]] auto current_dependency_graph() const {
         using Bound_Object = detail::Dependency_Graph_Bound_Object<Tag, Dependency_Graph_Types>;
-        const Dependency_Graph* graph = data().dependency_graph_storage.template get<Tag>().current;
+        const auto graph =
+            data().dependency_graph_storage.template get<Tag>().current;
         return graph->typed_view<Bound_Object>();
     }
     template <detail::Dependency_Graph_Tag_In<Dependency_Graph_Types>... Tags, detail::Dependency_Graph_Access_Callback_For<Dependency_Graph_Types, Tags...> Callback>
diff --git a/kernel/src/kernel/event.hpp b/kernel/src/kernel/event.hpp
index fcb2912..bd5127a 100644
--- a/kernel/src/kernel/event.hpp
+++ b/kernel/src/kernel/event.hpp
@@ -1,9 +1,11 @@
 #pragma once
 #include "frame_statistics.hpp"
+#include "ownership.hpp"
 #include <array>
 #include <atomic>
 #include <concepts>
 #include <cstdint>
+#include <optional>
 #include <type_traits>
 namespace aethera {
 enum struct Event_Type : std::uint8_t {
@@ -70,9 +72,10 @@ struct Event {
     const Event_Timeline_Time occurred_at; /* 控制器消费的原始事件时间，不参与内核排队耗时统计。 */
 private:
     friend struct Scene;
-    void observe_with(Event_Statistics_Accumulator* accumulator) noexcept;
+    void observe_with(
+        not_null<Event_Statistics_Accumulator*> accumulator) noexcept;
     std::uint64_t created_steady_ns_{}; /* 事件对象进入 Scene 前的内核单调时刻。 */
-    Event_Statistics_Accumulator* statistics_{}; /* 所属 Scene 的统计器；不拥有且不得跨 Scene。 */
+    std::optional<not_null<Event_Statistics_Accumulator*>> statistics_{}; /* 所属 Scene 的统计器；不拥有且不得跨 Scene。 */
     mutable bool accepted{}; /* 处理链是否已经消费事件。 */
     mutable std::atomic_uint64_t dispatch_frame_sequence_{};
     mutable std::atomic_uint64_t dispatch_started_steady_ns_{};
diff --git a/kernel/src/kernel/event.ipp b/kernel/src/kernel/event.ipp
index 9ac1cc2..3e8b870 100644
--- a/kernel/src/kernel/event.ipp
+++ b/kernel/src/kernel/event.ipp
@@ -24,7 +24,7 @@ inline void Event::mark_dispatch_completed() const noexcept {
     const auto completed = detail::event_steady_time_ns();
     dispatch_completed_steady_ns_.store(completed, std::memory_order_release);
     if (statistics_)
-        statistics_->submit(
+        (*statistics_)->submit(
             type, created_steady_ns_,
             dispatch_started_steady_ns_.load(std::memory_order_acquire),
             completed);
@@ -36,7 +36,7 @@ inline Event::Dispatch_Timing Event::dispatch_timing() const noexcept {
             dispatch_completed_steady_ns_.load(std::memory_order_acquire)};
 }
 inline void Event::observe_with(
-    Event_Statistics_Accumulator* accumulator) noexcept {
+    not_null<Event_Statistics_Accumulator*> accumulator) noexcept {
     statistics_ = accumulator;
 }
 constexpr Keyboard_Modifier operator|(Keyboard_Modifier left, Keyboard_Modifier right) noexcept { return static_cast<Keyboard_Modifier>(static_cast<std::uint8_t>(left) | static_cast<std::uint8_t>(right)); }
diff --git a/kernel/src/kernel/frame.cpp b/kernel/src/kernel/frame.cpp
index a087f4b..9df51e8 100644
--- a/kernel/src/kernel/frame.cpp
+++ b/kernel/src/kernel/frame.cpp
@@ -195,15 +195,17 @@ Taskflow_Frame_Trace Render_Frame::take_taskflow_trace() {
     });
 
     struct Node_Context {
-        const Taskflow_Graph_Trace* graph{};
-        const Taskflow_Graph_Trace::Node* node{};
+        not_null<const Taskflow_Graph_Trace*> graph;
+        not_null<const Taskflow_Graph_Trace::Node*> node;
     };
     std::unordered_map<std::uint64_t, Node_Context> nodes;
     std::unordered_map<std::string, std::uint64_t> native_id_by_node_id;
     std::unordered_map<std::string, std::vector<std::uint64_t>> children_by_parent_id;
     for (const auto& graph : result.graphs) {
         for (const auto& node : graph.nodes) {
-            nodes.try_emplace(node.native_id, Node_Context{&graph, &node});
+            nodes.try_emplace(
+                node.native_id,
+                Node_Context{not_null{&graph}, not_null{&node}});
             native_id_by_node_id.try_emplace(node.node_id, node.native_id);
             if (!node.parent_node_id.empty())
                 children_by_parent_id[node.parent_node_id].push_back(node.native_id);
@@ -408,13 +410,12 @@ detail::Taskflow_Graph_Token detail::Taskflow_Frame_Access::begin_graph(
     graph.submitted_ms = std::chrono::duration<double, std::milli>(
         Clock::now() - frame.d->created_at).count();
     frame.d->taskflow_graphs.push_back(std::move(graph));
-    return {&frame, frame.d->taskflow_graphs.size() - 1};
+    return {not_null{&frame}, frame.d->taskflow_graphs.size() - 1};
 }
 
 void detail::Taskflow_Frame_Access::finish_graph(
     detail::Taskflow_Graph_Token token,
     const detail::Taskflow_Graph_Timing& timing) noexcept {
-    if (!token.frame) return;
     auto& data = *token.frame->d;
     const auto elapsed_ms = [&](Clock::time_point value) {
         return value == Clock::time_point{} ? 0.0
diff --git a/kernel/src/kernel/ownership.hpp b/kernel/src/kernel/ownership.hpp
new file mode 100644
index 0000000..295bb1d
--- /dev/null
+++ b/kernel/src/kernel/ownership.hpp
@@ -0,0 +1,7 @@
+#pragma once
+#include <gsl/pointers>
+
+namespace aethera {
+using gsl::not_null;
+using gsl::owner;
+}
diff --git a/kernel/src/kernel/render_common.cpp b/kernel/src/kernel/render_common.cpp
index 71fba57..bc4f23f 100644
--- a/kernel/src/kernel/render_common.cpp
+++ b/kernel/src/kernel/render_common.cpp
@@ -36,7 +36,8 @@ tf::Taskflow& native_taskflow(Task_Graph& graph) noexcept {
     return *static_cast<tf::Taskflow*>(
         detail::Task_Graph_Access::native_storage(graph));
 }
-Render_Frame* task_frame(const tf::TaskView& task) noexcept {
+std::optional<not_null<Render_Frame*>> task_frame(
+    const tf::TaskView& task) noexcept {
     /*
      * Taskflow v4.1.0 ABI: TaskView 的 offset 0 是唯一的 const Node&，Task 的
      * offset 0 是唯一的 Node*。这里把同一 Node 转成公开 Task 句柄，只读取
@@ -49,7 +50,10 @@ Render_Frame* task_frame(const tf::TaskView& task) noexcept {
     auto* node = *reinterpret_cast<tf::Node* const*>(std::addressof(task));
     tf::Task handle{};
     *reinterpret_cast<tf::Node**>(std::addressof(handle)) = node;
-    return static_cast<Render_Frame*>(handle.data());
+    auto* frame = static_cast<Render_Frame*>(handle.data());
+    return frame
+        ? std::optional<not_null<Render_Frame*>>{not_null{frame}}
+        : std::nullopt;
 }
 #if defined(_WIN32)
 std::uint64_t thread_cpu_ns(HANDLE thread) noexcept {
@@ -119,7 +123,7 @@ private:
         std::uint64_t maximum_segment_ns{}; /* 已结束连续独占片段的最大墙钟。 */
         Clock::time_point cooperative_wait_started{}; /* 主动 corun 让出 Worker 的墙钟起点。 */
         std::uint64_t cooperative_wait_ns{}; /* 已累计 cooperative wait 墙钟。 */
-        Render_Frame* frame{}; /* 进入任务时唯一活动的按帧捕获。 */
+        std::optional<not_null<Render_Frame*>> frame{}; /* 进入任务时唯一活动的按帧捕获。 */
         std::size_t queue_size{}; /* 进入任务时 worker 队列深度。 */
         std::size_t queue_capacity{}; /* 进入任务时 worker 队列容量。 */
         std::uint64_t native_id{}; /* 嵌套 corun 返回外层任务时恢复其原生身份。 */
@@ -356,7 +360,7 @@ public:
         record.native_id = static_cast<std::uint64_t>(task.hash_value());
         record.type = task.type();
         worker_starts.push_back(std::move(record));
-        Render_Frame* frame = task_frame(task);
+        const auto frame = task_frame(task);
         worker_starts.back().frame = frame;
         const auto active_depth = worker_state.active_depth.fetch_add(
             1, std::memory_order_relaxed) + 1;
@@ -430,7 +434,7 @@ public:
         if (start.frame) {
             try {
                 trace_task = detail::Taskflow_Frame_Access::append_task(
-                    *start.frame, worker.id(),
+                    **start.frame, worker.id(),
                     static_cast<std::uint64_t>(task.hash_value()),
                     start.queue_size, start.queue_capacity, start.entered,
                     start.started, finished, start.cooperative_wait_ns);
@@ -443,7 +447,7 @@ public:
         if (start.frame) {
             if (trace_task)
                 detail::Taskflow_Frame_Access::finish_task_observer(
-                    *start.frame, worker.id(), *trace_task, completed);
+                    **start.frame, worker.id(), *trace_task, completed);
         }
         if (worker_starts.empty()) {
             auto busy = static_cast<std::uint64_t>(
@@ -662,7 +666,7 @@ struct Task_Resource : Pinned {
 private:
     std::unique_ptr<tf::Executor> executor;
     std::shared_ptr<Task_Observer> observer;
-    std::pmr::memory_resource* memory;
+    not_null<std::pmr::memory_resource*> memory;
     std::atomic_size_t active_taskflows{};
     std::atomic_size_t peak_active_taskflows{};
     std::atomic_size_t completed_taskflows{};
@@ -790,7 +794,7 @@ public:
                 "Taskflow worker occupation limit must be positive");
         std::lock_guard guard(state_mutex);
         configuration = value;
-        memory = configuration.pmr.resource();
+        memory = not_null{configuration.pmr.resource()};
         create_executor(configuration.workers, std::move(worker_interface));
         active_taskflows.store(0, std::memory_order_relaxed);
         peak_active_taskflows.store(0, std::memory_order_relaxed);
@@ -798,12 +802,12 @@ public:
         failed_taskflows.store(0, std::memory_order_relaxed);
     }
     std::uint64_t run(Task_Graph& taskflow) {
-        detail::Task_Graph_Access::bind_frame(taskflow, nullptr);
+        detail::Task_Graph_Access::bind_frame(taskflow, std::nullopt);
         return run_synchronous(taskflow, nullptr);
     }
     void run(Task_Graph& taskflow, std::function<void()> completion) {
         if (!completion) throw std::invalid_argument("Taskflow completion is empty");
-        detail::Task_Graph_Access::bind_frame(taskflow, nullptr);
+        detail::Task_Graph_Access::bind_frame(taskflow, std::nullopt);
         run_asynchronous(taskflow, false, [completion = std::move(completion)](
             detail::Taskflow_Graph_Timing) mutable {
             completion();
@@ -820,17 +824,19 @@ public:
          * 3. 多 worker 会并发附加 trace；Frame 必须按 worker 隔离单写者，不能共享写同一容器。
          */
         detail::Task_Graph_Access::bind_frame(
-            taskflow, frame.taskflow_trace_requested() ? &frame : nullptr);
+            taskflow, frame.taskflow_trace_requested()
+                ? std::optional<not_null<Render_Frame*>>{not_null{&frame}}
+                : std::nullopt);
         detail::Taskflow_Graph_Timing timing{};
         try {
             const auto elapsed = run_synchronous(taskflow, &timing);
-            detail::Task_Graph_Access::bind_frame(taskflow, nullptr);
+            detail::Task_Graph_Access::bind_frame(taskflow, std::nullopt);
             timing.observer_unbind_finished = std::chrono::steady_clock::now();
             detail::Taskflow_Frame_Access::finish_graph(token, timing);
             return elapsed;
         }
         catch (...) {
-            detail::Task_Graph_Access::bind_frame(taskflow, nullptr);
+            detail::Task_Graph_Access::bind_frame(taskflow, std::nullopt);
             timing.observer_unbind_finished = std::chrono::steady_clock::now();
             detail::Taskflow_Frame_Access::finish_graph(token, timing);
             throw;
@@ -843,11 +849,14 @@ public:
             frame, taskflow, stage);
         try {
             detail::Task_Graph_Access::bind_frame(
-                taskflow, frame.taskflow_trace_requested() ? &frame : nullptr);
+                taskflow, frame.taskflow_trace_requested()
+                    ? std::optional<not_null<Render_Frame*>>{
+                          not_null{&frame}}
+                    : std::nullopt);
             run_asynchronous(taskflow, true, [this, &taskflow, &frame, token,
                                        completion = std::move(completion)](
                 detail::Taskflow_Graph_Timing timing) mutable {
-                detail::Task_Graph_Access::bind_frame(taskflow, nullptr);
+                detail::Task_Graph_Access::bind_frame(taskflow, std::nullopt);
                 timing.observer_unbind_finished = std::chrono::steady_clock::now();
                 detail::Taskflow_Frame_Access::finish_graph(token, timing);
                 completion();
@@ -855,7 +864,7 @@ public:
         }
         catch (...) {
             detail::Taskflow_Graph_Timing timing{};
-            detail::Task_Graph_Access::bind_frame(taskflow, nullptr);
+            detail::Task_Graph_Access::bind_frame(taskflow, std::nullopt);
             timing.observer_unbind_finished = std::chrono::steady_clock::now();
             detail::Taskflow_Frame_Access::finish_graph(token, timing);
             throw;
@@ -884,7 +893,7 @@ public:
         observer->resume_worker(worker->id());
     }
     std::pmr::memory_resource* memory_resource() const noexcept {
-        return memory;
+        return memory.get();
     }
     void set_state_callback(std::function<void(const Task_Runtime_State &)> callback) {
         ensure_executor();
diff --git a/kernel/src/kernel/scene.ipp b/kernel/src/kernel/scene.ipp
index d3cbd11..9a1d1ea 100644
--- a/kernel/src/kernel/scene.ipp
+++ b/kernel/src/kernel/scene.ipp
@@ -29,7 +29,11 @@ struct Scene::Private : Prev_Private {
     void process(Object* object, Callback&& callback) requires std::invocable<Callback, const Result&>;
     /* 派生渲染 Scene 使用：把调用方外部帧贯穿公共 Prepare 阶段并追加诊断标记。 */
     template <Attached Object, typename Callback>
-    void process(Object* object, Render_Frame* frame, Callback&& callback) requires std::invocable<Callback, const Result&>;
+    void process(
+        Object* object,
+        std::optional<not_null<Render_Frame*>> frame,
+        Callback&& callback)
+        requires std::invocable<Callback, const Result&>;
     /* 派生 Scene 的 Private 还可覆盖 Def::Private 的四个 State 生命周期 hook，并通过 State_Access::get<Tag>() 访问状态层。 */
 };
 struct Scene::Private::Runtime {
@@ -60,17 +64,22 @@ std::shared_ptr<Event_Object_Type> Scene::make_event(Arguments&&... arguments) {
 }
 template <Attached Object, typename Callback>
 void Scene::Private::process(Object* object, Callback&& callback) requires std::invocable<Callback, const Result&> {
-    process(object, static_cast<Render_Frame*>(nullptr), std::forward<Callback>(callback));
+    process(object, std::nullopt, std::forward<Callback>(callback));
 }
 template <Attached Object, typename Callback>
-void Scene::Private::process(Object* object, Render_Frame* frame, Callback&& callback) requires std::invocable<Callback, const Result&> {
-    if (frame) frame->mark(Frame_Trace_Marker::prepare_started);
+void Scene::Private::process(
+    Object* object,
+    std::optional<not_null<Render_Frame*>> frame,
+    Callback&& callback)
+    requires std::invocable<Callback, const Result&> {
+    if (frame) (*frame)->mark(Frame_Trace_Marker::prepare_started);
     if (runtime->taskflow && !runtime->taskflow->empty())
-        if (frame && frame->taskflow_trace_requested())
-            (void)detail::run_taskflow(*runtime->taskflow, *frame, "scene.renderables");
+        if (frame && (*frame)->taskflow_trace_requested())
+            (void)detail::run_taskflow(
+                *runtime->taskflow, **frame, "scene.renderables");
         else
             (void)detail::run_taskflow(*runtime->taskflow);
-    if (frame) frame->mark(Frame_Trace_Marker::prepare_finished);
+    if (frame) (*frame)->mark(Frame_Trace_Marker::prepare_finished);
     double_buffer::detail::Internal_Access::current_dependency_graph<Render_Graph_Tag>(object).for_each_bound(
         [](Renderable* renderable, Renderable::Private& data) {
             data.publish_renderable_state(renderable);
@@ -184,23 +193,28 @@ void Scene::Private::after_advance(Object* object,
         dependency_graph.for_each(
             [&](const Dependency_Graph::Node& dependency_node) {
                 if (!dependency_graph.private_data(dependency_node)) return;
-                auto target = render_tasks.find(dependency_node.object);
+                auto target = render_tasks.find(dependency_node.object.get());
                 if (target == render_tasks.end()) return;
                 std::pmr::unordered_set<Root*> visited{resource};
-                std::pmr::vector<const Dependency_Graph::Node*> pending{resource};
-                for (const auto* dependency : dependency_node.dependencies) pending.push_back(dependency);
+                std::pmr::vector<not_null<Dependency_Graph::Node*>> pending{
+                    resource};
+                for (const auto dependency : dependency_node.dependencies)
+                    pending.push_back(dependency);
                 while (!pending.empty()) {
-                    const auto* dependency = pending.back();
+                    const auto dependency = pending.back();
                     pending.pop_back();
-                    if (!visited.insert(dependency->object).second) continue;
+                    if (!visited.insert(dependency->object.get()).second)
+                        continue;
                     if (dependency_graph.private_data(*dependency)) {
-                        auto source = render_tasks.find(dependency->object);
+                        auto source = render_tasks.find(
+                            dependency->object.get());
                         if (source != render_tasks.end()) {
                             source->second.exit.precede(target->second.entry);
                         }
                         continue;
                     }
-                    for (const auto* next : dependency->dependencies) pending.push_back(next);
+                    for (const auto next : dependency->dependencies)
+                        pending.push_back(next);
                 }
             }
         );
diff --git a/mcp/core/runtime/Gallery_Plots.cpp b/mcp/core/runtime/Gallery_Plots.cpp
index d6e1200..53548b8 100644
--- a/mcp/core/runtime/Gallery_Plots.cpp
+++ b/mcp/core/runtime/Gallery_Plots.cpp
@@ -36,11 +36,12 @@ std::span<const Plot_Definition> gallery_plot_definitions() noexcept {
     return definitions;
 }
 
-const Plot_Definition* find_gallery_plot_definition(
-    std::string_view id) noexcept {
+std::optional<not_null<const Plot_Definition*>>
+find_gallery_plot_definition(std::string_view id) noexcept {
     const auto found = std::ranges::find(definitions, id,
                                          &Plot_Definition::id);
-    return found == definitions.end() ? nullptr : &*found;
+    if (found == definitions.end()) return std::nullopt;
+    return not_null{&*found};
 }
 
 std::string_view plot_dimension_name(Plot_Dimension dimension) noexcept {
diff --git a/mcp/core/runtime/Gallery_Plots.hpp b/mcp/core/runtime/Gallery_Plots.hpp
index ae0049c..aacb87a 100644
--- a/mcp/core/runtime/Gallery_Plots.hpp
+++ b/mcp/core/runtime/Gallery_Plots.hpp
@@ -1,6 +1,8 @@
 #pragma once
 #include "Gallery_Plots_2D.hpp"
 #include "Gallery_Plots_3D.hpp"
+#include <optional>
+#include <ownership.hpp>
 #include <span>
 #include <string_view>
 
@@ -18,8 +20,8 @@ struct Plot_Definition {
 
 [[nodiscard]] std::span<const Plot_Definition>
 gallery_plot_definitions() noexcept;
-[[nodiscard]] const Plot_Definition* find_gallery_plot_definition(
-    std::string_view id) noexcept;
+[[nodiscard]] std::optional<not_null<const Plot_Definition*>>
+find_gallery_plot_definition(std::string_view id) noexcept;
 [[nodiscard]] std::string_view plot_dimension_name(
     Plot_Dimension dimension) noexcept;
 }
diff --git a/mcp/core/runtime/Gallery_Plots_2D.cpp b/mcp/core/runtime/Gallery_Plots_2D.cpp
index 0e6dc9a..d5a3713 100644
--- a/mcp/core/runtime/Gallery_Plots_2D.cpp
+++ b/mcp/core/runtime/Gallery_Plots_2D.cpp
@@ -508,16 +508,19 @@ std::unique_ptr<Time_Axis_Object> make_time_axis(
     return std::move(result).value();
 }
 template <Axis_Object Horizontal_Axis, Axis_Object Vertical_Axis>
-std::unique_ptr<Selection_Object> selection_overlay(Horizontal_Axis* horizontal_axis, Vertical_Axis* vertical_axis) {
+std::unique_ptr<Selection_Object> selection_overlay(
+    not_null<Horizontal_Axis*> horizontal_axis,
+    not_null<Vertical_Axis*> vertical_axis) {
     auto result = Selection_Object::Builder<Selection_Object>(horizontal_axis, vertical_axis).build();
     if (!result) throw std::logic_error("selection overlay axes form an invalid dependency graph");
     return std::move(result).value();
 }
 template <typename... Axes>
-void resize_axes(Scene_2D* scene, Size viewport, Axes*... axes) {
+void resize_axes(not_null<Scene_2D*> scene, Size viewport,
+                 not_null<Axes*>... axes) {
     const Size previous_viewport = scene->template read_prop<Render_Scene_2D::Base_Tag>().viewport;
     if (previous_viewport == viewport || previous_viewport.empty()) return;
-    const auto resize_axis = [&](auto* axis) {
+    const auto resize_axis = [&](auto axis) {
         const auto layout = axis->template read_prop<Abs_Axis::Base_Tag>();
         const double horizontal_scale = static_cast<double>(viewport.width) / previous_viewport.width;
         const double vertical_scale = static_cast<double>(viewport.height) / previous_viewport.height;
@@ -549,7 +552,10 @@ std::shared_ptr<Plot> make_axes_plot() {
                   .add_dependency_node<Render_Graph_Tag>(numeric.get())
                   .add_dependency_node<Render_Graph_Tag>(time.get())
                   .build();
-    auto update = [scene = scene.get(), frequency = frequency.get(), numeric = numeric.get(), time = time.get()](const Plot_Render_Tick& event, bool) {
+    auto update = [scene = not_null{scene.get()},
+                   frequency = not_null{frequency.get()},
+                   numeric = not_null{numeric.get()},
+                   time = not_null{time.get()}](const Plot_Render_Tick& event, bool) {
         resize_axes(scene, {static_cast<int>(event.width), static_cast<int>(event.height)}, frequency, numeric, time);
         constexpr double day_milliseconds = 86'400'000.0;
         time->append_time(Time_Of_Day{
@@ -570,7 +576,9 @@ std::shared_ptr<Plot> make_axes_plot() {
         generator_number_field("value_min", "数值下界", "数值轴可见坐标下界。", -100.0, -1'000'000'000.0, 1'000'000'000.0),
         generator_number_field("value_max", "数值上界", "数值轴可见坐标上界，必须大于下界。", 0.0, -1'000'000'000.0, 1'000'000'000.0)
     });
-    auto generate = [frequency = frequency.get(), numeric = numeric.get(), time = time.get()](const Json& input) {
+    auto generate = [frequency = not_null{frequency.get()},
+                     numeric = not_null{numeric.get()},
+                     time = not_null{time.get()}](const Json& input) {
         try {
             const auto sample_count = generator_count(input, "time_sample_count");
             const auto time_step = generator_count(input, "time_step_ms");
@@ -604,20 +612,25 @@ std::shared_ptr<Plot> make_spectrum_plot() {
     constexpr Size canvas{720, 420};
     auto frequency = make_frequency_axis();
     auto vertical = make_numeric_axis(Axis_Orientation::vertical, {64.0, 370.0}, -320.0, {-110.0, 0.0});
-    auto spectrum = *Spectrum::Builder<Spectrum>(frequency.get(), vertical.get(), 4u)
+    auto spectrum = *Spectrum::Builder<Spectrum>(
+                        not_null{frequency.get()}, not_null{vertical.get()}, 4u)
                      .set(&Spectrum::Prop::frequency_range, Axis_Range{0.0, 100.0})
                      .set(&Spectrum::Prop::max_hold_visible, true)
                      .build();
-    auto selection = selection_overlay(frequency.get(), vertical.get());
+    auto selection = selection_overlay(
+        not_null{frequency.get()}, not_null{vertical.get()});
     auto scene = *Scene_2D::Builder<Scene_2D>()
                   .set(&Render_Scene_2D::Prop::viewport, canvas)
                   .set(&Render_Scene_2D::Prop::background, Color{7, 13, 24, 255})
                   .set(&Render_Scene_2D::Prop::view_active, true)
-                  .add_renderable(spectrum.get())
-                  .add_renderable(selection.get())
+                  .add_renderable(not_null{spectrum.get()})
+                  .add_renderable(not_null{selection.get()})
                   .add_dependency<Render_Graph_Tag>(selection.get(), spectrum.get())
                   .build();
-    auto update = [scene = scene.get(), raw = spectrum.get(), frequency = frequency.get(), vertical = vertical.get()](const Plot_Render_Tick& event, bool demo_data) {
+    auto update = [scene = not_null{scene.get()},
+                   raw = not_null{spectrum.get()},
+                   frequency = not_null{frequency.get()},
+                   vertical = not_null{vertical.get()}](const Plot_Render_Tick& event, bool demo_data) {
         resize_axes(scene, {static_cast<int>(event.width), static_cast<int>(event.height)}, frequency, vertical);
         if (!demo_data) return;
         std::array < double, 256 > samples{};
@@ -667,17 +680,22 @@ std::shared_ptr<Plot> make_frequency_trace_plot() {
         Axis_Orientation::horizontal, {64.0, 370.0}, 620.0);
     auto vertical = make_numeric_axis(
         Axis_Orientation::vertical, {64.0, 370.0}, -320.0, {-1.2, 1.2});
-    auto trace = *Frequency_Trace::Builder<Frequency_Trace>(time.get(), vertical.get(), 4u).build();
-    auto selection = selection_overlay(time.get(), vertical.get());
+    auto trace = *Frequency_Trace::Builder<Frequency_Trace>(
+        not_null{time.get()}, not_null{vertical.get()}, 4u).build();
+    auto selection = selection_overlay(
+        not_null{time.get()}, not_null{vertical.get()});
     auto scene = *Scene_2D::Builder<Scene_2D>{}
                   .set(&Render_Scene_2D::Prop::viewport, canvas)
                   .set(&Render_Scene_2D::Prop::background, Color{7, 13, 24, 255})
                   .set(&Render_Scene_2D::Prop::view_active, true)
-                  .add_renderable(trace.get())
-                  .add_renderable(selection.get())
+                  .add_renderable(not_null{trace.get()})
+                  .add_renderable(not_null{selection.get()})
                   .add_dependency<Render_Graph_Tag>(selection.get(), trace.get())
                   .build();
-    auto update = [scene = scene.get(), raw = trace.get(), time = time.get(), vertical = vertical.get()](const Plot_Render_Tick& event, bool demo_data) {
+    auto update = [scene = not_null{scene.get()},
+                   raw = not_null{trace.get()},
+                   time = not_null{time.get()},
+                   vertical = not_null{vertical.get()}](const Plot_Render_Tick& event, bool demo_data) {
         resize_axes(scene, {static_cast<int>(event.width), static_cast<int>(event.height)}, time, vertical);
         if (!demo_data) return;
         constexpr double day_milliseconds = 86'400'000.0;
@@ -702,21 +720,26 @@ std::shared_ptr<Plot> make_sweep_spectrum_plot() {
     auto frequency = make_frequency_axis();
     auto vertical = make_numeric_axis(
         Axis_Orientation::vertical, {64.0, 370.0}, -320.0, {-110.0, 0.0});
-    auto sweep = *Sweep_Spectrum::Builder<Sweep_Spectrum>(frequency.get(), vertical.get(), 4u)
+    auto sweep = *Sweep_Spectrum::Builder<Sweep_Spectrum>(
+                     not_null{frequency.get()}, not_null{vertical.get()}, 4u)
                   .set(&Sweep_Spectrum::Prop::frequency_range, Axis_Range{0.0, 100.0})
                   .set(&Sweep_Spectrum::Prop::bins_per_block, std::size_t{8})
                   .set(&Sweep_Spectrum::Prop::block_count, std::size_t{64})
                   .build();
-    auto selection = selection_overlay(frequency.get(), vertical.get());
+    auto selection = selection_overlay(
+        not_null{frequency.get()}, not_null{vertical.get()});
     auto scene = *Scene_2D::Builder<Scene_2D>{}
                   .set(&Render_Scene_2D::Prop::viewport, canvas)
                   .set(&Render_Scene_2D::Prop::background, Color{7, 13, 24, 255})
                   .set(&Render_Scene_2D::Prop::view_active, true)
-                  .add_renderable(sweep.get())
-                  .add_renderable(selection.get())
+                  .add_renderable(not_null{sweep.get()})
+                  .add_renderable(not_null{selection.get()})
                   .add_dependency<Render_Graph_Tag>(selection.get(), sweep.get())
                   .build();
-    auto update = [scene = scene.get(), raw = sweep.get(), frequency = frequency.get(), vertical = vertical.get()](const Plot_Render_Tick& event, bool demo_data) {
+    auto update = [scene = not_null{scene.get()},
+                   raw = not_null{sweep.get()},
+                   frequency = not_null{frequency.get()},
+                   vertical = not_null{vertical.get()}](const Plot_Render_Tick& event, bool demo_data) {
         resize_axes(scene, {static_cast<int>(event.width), static_cast<int>(event.height)}, frequency, vertical);
         if (!demo_data) return;
         const auto& state = raw->template read_prop<Sweep_Spectrum::Base_Tag>();
@@ -751,21 +774,26 @@ std::shared_ptr<Plot> make_afterglow_plot() {
     auto vertical = make_numeric_axis(
         Axis_Orientation::vertical, {64.0, 370.0}, -320.0, {-110.0, 0.0});
     auto afterglow = *Afterglow::Builder<Afterglow>(
-                         frequency.get(), vertical.get(), Plot_Partition_Grid{4, 3})
+                         not_null{frequency.get()}, not_null{vertical.get()},
+                         Plot_Partition_Grid{4, 3})
                       .set(&Afterglow::Prop::frequency_range, Axis_Range{0.0, 100.0})
                       .set(&Afterglow::Prop::power_range, Axis_Range{-110.0, 0.0})
                       .set(&Afterglow::Prop::power_point_size, 96)
                       .build();
-    auto selection = selection_overlay(frequency.get(), vertical.get());
+    auto selection = selection_overlay(
+        not_null{frequency.get()}, not_null{vertical.get()});
     auto scene = *Scene_2D::Builder<Scene_2D>{}
                   .set(&Render_Scene_2D::Prop::viewport, canvas)
                   .set(&Render_Scene_2D::Prop::background, Color{7, 13, 24, 255})
                   .set(&Render_Scene_2D::Prop::view_active, true)
-                  .add_renderable(afterglow.get())
-                  .add_renderable(selection.get())
+                  .add_renderable(not_null{afterglow.get()})
+                  .add_renderable(not_null{selection.get()})
                   .add_dependency<Render_Graph_Tag>(selection.get(), afterglow.get())
                   .build();
-    auto update = [scene = scene.get(), raw = afterglow.get(), frequency = frequency.get(), vertical = vertical.get()](const Plot_Render_Tick& event, bool demo_data) {
+    auto update = [scene = not_null{scene.get()},
+                   raw = not_null{afterglow.get()},
+                   frequency = not_null{frequency.get()},
+                   vertical = not_null{vertical.get()}](const Plot_Render_Tick& event, bool demo_data) {
         resize_axes(scene, {static_cast<int>(event.width), static_cast<int>(event.height)}, frequency, vertical);
         if (!demo_data) return;
         std::array < double, 192 > values{};
@@ -795,20 +823,25 @@ std::shared_ptr<Plot> make_waterfall_plot() {
     auto time = make_time_axis(
         Axis_Orientation::vertical, {64.0, 370.0}, -320.0);
     auto waterfall = *Waterfall::Builder<Waterfall>(
-                         frequency.get(), time.get(), Plot_Partition_Grid{4, 3})
+                         not_null{frequency.get()}, not_null{time.get()},
+                         Plot_Partition_Grid{4, 3})
                       .set(&Waterfall::Prop::frequency_range, Axis_Range{0.0, 100.0})
                       .set(&Waterfall::Prop::power_range, Axis_Range{-110.0, 0.0})
                       .build();
-    auto selection = selection_overlay(frequency.get(), time.get());
+    auto selection = selection_overlay(
+        not_null{frequency.get()}, not_null{time.get()});
     auto scene = *Scene_2D::Builder<Scene_2D>{}
                   .set(&Render_Scene_2D::Prop::viewport, canvas)
                   .set(&Render_Scene_2D::Prop::background, Color{7, 13, 24, 255})
                   .set(&Render_Scene_2D::Prop::view_active, true)
-                  .add_renderable(waterfall.get())
-                  .add_renderable(selection.get())
+                  .add_renderable(not_null{waterfall.get()})
+                  .add_renderable(not_null{selection.get()})
                   .add_dependency<Render_Graph_Tag>(selection.get(), waterfall.get())
                   .build();
-    auto update = [scene = scene.get(), raw = waterfall.get(), frequency = frequency.get(), time = time.get()](const Plot_Render_Tick& event, bool demo_data) {
+    auto update = [scene = not_null{scene.get()},
+                   raw = not_null{waterfall.get()},
+                   frequency = not_null{frequency.get()},
+                   time = not_null{time.get()}](const Plot_Render_Tick& event, bool demo_data) {
         resize_axes(scene, {static_cast<int>(event.width), static_cast<int>(event.height)}, frequency, time);
         if (!demo_data) return;
         constexpr double day_milliseconds = 86'400'000.0;
@@ -849,20 +882,25 @@ std::shared_ptr<Plot> make_constellation_plot() {
     auto vertical = make_numeric_axis(
         Axis_Orientation::vertical, {64.0, 370.0}, -320.0, {-1.2, 1.2});
     auto constellation = *Constellation_Diagram::Builder<Constellation_Diagram>(
-                             horizontal.get(), vertical.get(), 4u)
+                             not_null{horizontal.get()},
+                             not_null{vertical.get()}, 4u)
                           .set(&Constellation_Diagram::Prop::i_range, Axis_Range{-1.2, 1.2})
                           .set(&Constellation_Diagram::Prop::q_range, Axis_Range{-1.2, 1.2})
                           .build();
-    auto selection = selection_overlay(horizontal.get(), vertical.get());
+    auto selection = selection_overlay(
+        not_null{horizontal.get()}, not_null{vertical.get()});
     auto scene = *Scene_2D::Builder<Scene_2D>{}
                   .set(&Render_Scene_2D::Prop::viewport, canvas)
                   .set(&Render_Scene_2D::Prop::background, Color{7, 13, 24, 255})
                   .set(&Render_Scene_2D::Prop::view_active, true)
-                  .add_renderable(constellation.get())
-                  .add_renderable(selection.get())
+                  .add_renderable(not_null{constellation.get()})
+                  .add_renderable(not_null{selection.get()})
                   .add_dependency<Render_Graph_Tag>(selection.get(), constellation.get())
                   .build();
-    auto update = [scene = scene.get(), raw = constellation.get(), horizontal = horizontal.get(), vertical = vertical.get()](const Plot_Render_Tick& event, bool demo_data) {
+    auto update = [scene = not_null{scene.get()},
+                   raw = not_null{constellation.get()},
+                   horizontal = not_null{horizontal.get()},
+                   vertical = not_null{vertical.get()}](const Plot_Render_Tick& event, bool demo_data) {
         resize_axes(scene, {static_cast<int>(event.width), static_cast<int>(event.height)}, horizontal, vertical);
         if (!demo_data) return;
         const auto& state = raw->template read_prop<Constellation_Diagram::Base_Tag>();
@@ -904,14 +942,17 @@ std::shared_ptr<Plot> make_selection_overlay_plot() {
         Axis_Orientation::horizontal, {64.0, 370.0}, 620.0, {0.0, 100.0});
     auto vertical = make_numeric_axis(
         Axis_Orientation::vertical, {64.0, 370.0}, -320.0, {0.0, 100.0});
-    auto selection = *Selection_Rectangle_Overlay::Builder<Selection_Rectangle_Overlay>(horizontal.get(), vertical.get()).build();
+    auto selection = *Selection_Rectangle_Overlay::Builder<Selection_Rectangle_Overlay>(
+        not_null{horizontal.get()}, not_null{vertical.get()}).build();
     auto scene = *Scene_2D::Builder<Scene_2D>{}
                   .set(&Render_Scene_2D::Prop::viewport, canvas)
                   .set(&Render_Scene_2D::Prop::background, Color{7, 13, 24, 255})
                   .set(&Render_Scene_2D::Prop::view_active, true)
-                  .add_renderable(selection.get())
+                  .add_renderable(not_null{selection.get()})
                   .build();
-    auto update = [scene = scene.get(), horizontal = horizontal.get(), vertical = vertical.get()](const Plot_Render_Tick& event, bool) {
+    auto update = [scene = not_null{scene.get()},
+                   horizontal = not_null{horizontal.get()},
+                   vertical = not_null{vertical.get()}](const Plot_Render_Tick& event, bool) {
         resize_axes(scene, {static_cast<int>(event.width), static_cast<int>(event.height)}, horizontal, vertical);
     };
     auto view = make_scene_view<
diff --git a/mcp/core/runtime/Gallery_Plots_3D.cpp b/mcp/core/runtime/Gallery_Plots_3D.cpp
index fb30880..b3f2afe 100644
--- a/mcp/core/runtime/Gallery_Plots_3D.cpp
+++ b/mcp/core/runtime/Gallery_Plots_3D.cpp
@@ -437,11 +437,15 @@ public:
     }
     void update(const Plot_Render_Tick& request) override {
         if constexpr (requires(Data_Generator& generator, Visual_Object& visual,
-                               Axes_Object& axes, Marker_Object* markers,
+                               Axes_Object& axes,
+                               std::optional<not_null<Marker_Object*>> markers,
                                const Plot_Render_Tick& frame) {
             generator.update(visual, axes, markers, frame);
         }) {
-            data_generator_.update(*visual_, *axes_, markers_.get(), request);
+            const auto markers = markers_
+                ? std::optional{not_null{markers_.get()}}
+                : std::nullopt;
+            data_generator_.update(*visual_, *axes_, markers, request);
         }
     }
 private:
@@ -494,13 +498,13 @@ std::shared_ptr<Plot> make_visual_plot(std::string label,
     auto camera = std::move(camera_result).value();
     auto axes = std::move(axes_result).value();
     auto scene_builder = Scene_3D::Builder<Scene_3D>{};
-    scene_builder.add_camera(camera.get())
-                 .add_axes(axes.get())
-                 .add_renderable(visual.get())
+    scene_builder.add_camera(not_null{camera.get()})
+                 .add_axes(not_null{axes.get()})
+                 .add_renderable(not_null{visual.get()})
                  .set(&Render_Scene_3D::Prop::viewport, Extent{720, 420})
                  .set(&Render_Scene_3D::Prop::clear_color, Linear_Color{0.018F, 0.027F, 0.047F, 1.0F})
                  .set(&Render_Scene_3D::Prop::view_active, true);
-    if (markers) scene_builder.add_renderable(markers.get());
+    if (markers) scene_builder.add_renderable(not_null{markers.get()});
     auto scene_result = scene_builder.build();
     if (!scene_result) throw std::logic_error("3D Gallery scene dependency graph is invalid");
     auto scene = std::move(scene_result).value();
@@ -744,7 +748,7 @@ struct Spectrogram_Data_Generator {
         }
     }
     void update(Mesh_Visual& visual, Axes_3D&,
-                Marker_Visual* markers,
+                std::optional<not_null<Marker_Visual*>> markers,
                 const Plot_Render_Tick& request) {
         if (!parameters.animation_enabled ||
             request.sequence % parameters.update_every_n_frames != 0)
@@ -752,15 +756,15 @@ struct Spectrogram_Data_Generator {
         const double animation_seconds = request.time_milliseconds / 1000.0 * parameters.animation_speed;
         auto mesh = spectrogram_mesh(parameters, animation_seconds);
         visual.template set<&Mesh_Visual::Prop::items>(std::move(mesh));
-        if (markers == nullptr) return;
-        auto items = markers->template read_prop<Marker_Visual::Base_Tag>().items;
+        if (!markers) return;
+        auto items = (*markers)->template read_prop<Marker_Visual::Base_Tag>().items;
         for (auto& marker : items) {
             const float time = std::clamp((marker.position.x + 1.0F) * 0.5F, 0.0F, 1.0F);
             const float frequency = std::clamp((marker.position.y + 1.0F) * 0.5F, 0.0F, 1.0F);
             marker.position.z = -1.0F + 2.0F * spectrogram_level(
                 time, frequency, animation_seconds, parameters.ridge_count);
         }
-        markers->template set<&Marker_Visual::Prop::items>(std::move(items));
+        (*markers)->template set<&Marker_Visual::Prop::items>(std::move(items));
     }
 };
 }
diff --git a/mcp/core/runtime/Plot.cpp b/mcp/core/runtime/Plot.cpp
index 0b0d49a..8f8b6af 100644
--- a/mcp/core/runtime/Plot.cpp
+++ b/mcp/core/runtime/Plot.cpp
@@ -637,11 +637,11 @@ struct Plot::Private {
     void refresh_schedule();
     void clock_tick(const Plot_Render_Tick& tick);
     void render_frame(Plot_Render_Tick tick);
-    void publish_completed_frame(Render_Frame* completed);
-    void consume_completed_frame(Render_Frame* frame);
-    void retire_completed_frame(Render_Frame* frame);
+    void publish_completed_frame(not_null<Render_Frame*> completed);
+    void consume_completed_frame(not_null<Render_Frame*> frame);
+    void retire_completed_frame(not_null<Render_Frame*> frame);
     void consume_retired_frames();
-    void finalize_retired_frame(Render_Frame* frame);
+    void finalize_retired_frame(not_null<Render_Frame*> frame);
     void attach_completion(std::unique_ptr<Task_Graph> completion);
     [[nodiscard]] bool mark_taskflow_trace(Render_Frame& frame);
     [[nodiscard]] bool mark_post_publish_taskflow_trace();
@@ -1095,7 +1095,20 @@ void Plot::Private::render_frame(Plot_Render_Tick tick) {
             record_plot_measurements(output);
             (*scene_2d)->set<&Render_Scene_2D::Prop::viewport>(
                 Size{static_cast<int>(tick.width), static_cast<int>(tick.height)});
-            const auto result = (*scene_2d)->render(&output);
+            const auto result = (*scene_2d)->render(
+                &output,
+                [weak = lifetime](not_null<Frame_2D*> frame) {
+                    if (auto owner = weak.lock()) {
+                        try {
+                            owner->d->publish_completed_frame(frame);
+                            owner->d->consume_completed_frame(frame);
+                            owner->d->retire_completed_frame(frame);
+                        }
+                        catch (...) {
+                            owner->d->fail(std::current_exception());
+                        }
+                    }
+                });
             if (!result) {
                 with_frame_policy([](auto& policy) {
                     policy.record_scene_rejection();
@@ -1147,24 +1160,25 @@ void Plot::Private::render_frame(Plot_Render_Tick tick) {
 }
 
 
-void Plot::Private::publish_completed_frame(Render_Frame* completed) {
-    if (!completed)
-        throw std::invalid_argument("Plot received a null completed frame");
-    Managed_Frame* managed{};
+void Plot::Private::publish_completed_frame(
+    not_null<Render_Frame*> completed) {
+    std::optional<not_null<Managed_Frame*>> managed;
     for (auto& slot : frame_slots) {
-        auto* frame = std::visit(
-            [](const auto& value) -> Render_Frame* { return value.get(); },
+        const auto frame = std::visit(
+            [](const auto& value) -> not_null<Render_Frame*> {
+                return not_null{value.get()};
+            },
             slot.frame);
-        if (frame != completed) continue;
+        if (frame.get() != completed.get()) continue;
         managed = &slot;
         break;
     }
     if (!managed)
         throw std::logic_error("completed frame has no owning Plot policy slot");
-    if (managed->state.load(std::memory_order_acquire) !=
+    if ((*managed)->state.load(std::memory_order_acquire) !=
         Frame_State::rendering)
         throw std::logic_error("completed Plot frame is not rendering");
-    auto* frame = completed;
+    const auto frame = completed;
 
     const auto& pacing = pacing_state();
     const auto identity = frame->identity();
@@ -1174,7 +1188,7 @@ void Plot::Private::publish_completed_frame(Render_Frame* completed) {
     std::uint32_t width{};
     std::uint32_t height{};
     if (auto *frame_2d =
-            std::get_if<std::unique_ptr<Frame_2D>>(&managed->frame)) {
+            std::get_if<std::unique_ptr<Frame_2D>>(&(*managed)->frame)) {
       pixel_layout = Plot_Pixel_Layout::bgra8;
       const auto image = (*frame_2d)->image();
       width = static_cast<std::uint32_t>(image.width);
@@ -1187,7 +1201,7 @@ void Plot::Private::publish_completed_frame(Render_Frame* completed) {
         height = static_cast<std::uint32_t>(output.height);
       }
     } else {
-      auto &frame_3d = std::get<std::unique_ptr<Frame_3D>>(managed->frame);
+        auto &frame_3d = std::get<std::unique_ptr<Frame_3D>>((*managed)->frame);
       rendered_identity = frame_3d->rendered_identity();
       const auto extent = frame_3d->extent();
       width = extent.width;
@@ -1197,7 +1211,7 @@ void Plot::Private::publish_completed_frame(Render_Frame* completed) {
     }
 
     auto pixels = std::make_shared<const Plot_Pixel_Frame>(Plot_Pixel_Frame{
-        std::move(pixel_storage), pixel_layout, managed->presentation_time,
+        std::move(pixel_storage), pixel_layout, (*managed)->presentation_time,
         identity.sequence, identity.correlation_id, rendered_identity.sequence,
         rendered_identity.correlation_id, width, height});
 
@@ -1211,21 +1225,21 @@ void Plot::Private::publish_completed_frame(Render_Frame* completed) {
                              std::chrono::steady_clock::now() - publish_started)
                              .count())));
     auto expected = Frame_State::rendering;
-    if (!managed->state.compare_exchange_strong(
+    if (!(*managed)->state.compare_exchange_strong(
             expected, Frame_State::consuming, std::memory_order_acq_rel,
             std::memory_order_acquire))
       throw std::logic_error("Plot frame left rendering before pixel publish");
 }
 
-void Plot::Private::consume_completed_frame(Render_Frame* frame) {
-    if (!frame)
-        throw std::invalid_argument("Plot received a null completed frame");
-    Managed_Frame* managed{};
+void Plot::Private::consume_completed_frame(not_null<Render_Frame*> frame) {
+    std::optional<not_null<Managed_Frame*>> managed;
     for (auto& slot : frame_slots) {
-        auto* address = std::visit(
-            [](const auto& value) -> Render_Frame* { return value.get(); },
+        const auto address = std::visit(
+            [](const auto& value) -> not_null<Render_Frame*> {
+                return not_null{value.get()};
+            },
             slot.frame);
-        if (address != frame) continue;
+        if (address.get() != frame.get()) continue;
         if (slot.state.load(std::memory_order_acquire) != Frame_State::consuming)
             throw std::logic_error("completed Plot frame was not published");
         managed = &slot;
@@ -1239,7 +1253,7 @@ void Plot::Private::consume_completed_frame(Render_Frame* frame) {
      * 释放 Plot 的 view/update 门，并立刻唤醒 busy 期间保留的 latest tick。
      * 之后外接 DAG 仍在当前 Frame trace 内执行，但不会阻塞下一帧渲染。
      */
-    if (std::holds_alternative<std::unique_ptr<Frame_2D>>(managed->frame))
+    if (std::holds_alternative<std::unique_ptr<Frame_2D>>((*managed)->frame))
         release_render_admission(lifetime);
     if (post_publish_graph.empty()) return;
 
@@ -1321,15 +1335,15 @@ void Plot::Private::consume_retired_frames() {
     }
 }
 
-void Plot::Private::retire_completed_frame(Render_Frame* frame) {
-    if (!frame)
-        throw std::invalid_argument("Plot received a null retired frame");
-    Managed_Frame* managed{};
+void Plot::Private::retire_completed_frame(not_null<Render_Frame*> frame) {
+    std::optional<not_null<Managed_Frame*>> managed;
     for (auto& slot : frame_slots) {
-        auto* address = std::visit(
-            [](const auto& value) -> Render_Frame* { return value.get(); },
+        const auto address = std::visit(
+            [](const auto& value) -> not_null<Render_Frame*> {
+                return not_null{value.get()};
+            },
             slot.frame);
-        if (address != frame) continue;
+        if (address.get() != frame.get()) continue;
         managed = &slot;
         break;
     }
@@ -1338,20 +1352,22 @@ void Plot::Private::retire_completed_frame(Render_Frame* frame) {
 
     auto* head = retired_frames.load(std::memory_order_relaxed);
     do {
-        managed->retired_next.store(head, std::memory_order_relaxed);
+        (*managed)->retired_next.store(head, std::memory_order_relaxed);
     } while (!retired_frames.compare_exchange_weak(
-        head, managed, std::memory_order_release,
+        head, managed->get(), std::memory_order_release,
         std::memory_order_relaxed));
     arm_tick_consumer(lifetime);
 }
 
-void Plot::Private::finalize_retired_frame(Render_Frame* frame) {
-    Managed_Frame* managed{};
+void Plot::Private::finalize_retired_frame(not_null<Render_Frame*> frame) {
+    std::optional<not_null<Managed_Frame*>> managed;
     for (auto& slot : frame_slots) {
-        auto* address = std::visit(
-            [](const auto& value) -> Render_Frame* { return value.get(); },
+        const auto address = std::visit(
+            [](const auto& value) -> not_null<Render_Frame*> {
+                return not_null{value.get()};
+            },
             slot.frame);
-        if (address == frame) {
+        if (address.get() == frame.get()) {
             managed = &slot;
             break;
         }
@@ -1360,11 +1376,11 @@ void Plot::Private::finalize_retired_frame(Render_Frame* frame) {
         throw std::logic_error("retired frame has no owned Plot slot");
 
     const auto completion_latency =
-        managed->submitted_at.time_since_epoch().count() == 0
+        (*managed)->submitted_at.time_since_epoch().count() == 0
             ? std::chrono::steady_clock::duration::zero()
-            : std::chrono::steady_clock::now() - managed->submitted_at;
+            : std::chrono::steady_clock::now() - (*managed)->submitted_at;
     std::optional<Datoviz_Frame_Observation> datoviz_observation;
-    if (auto* frame_3d = dynamic_cast<Frame_3D*>(frame)) {
+    if (auto* frame_3d = dynamic_cast<Frame_3D*>(frame.get())) {
         datoviz_observation = frame_3d->take_datoviz_observation();
         if (!datoviz_observation)
             throw std::logic_error(
@@ -1384,8 +1400,8 @@ void Plot::Private::finalize_retired_frame(Render_Frame* frame) {
         completed_frame_statistics.reset();
         applied_statistics_generation = statistics_generation_value;
     }
-    managed->statistics = completed_frame_statistics.submit(*frame);
-    managed->statistics_generation = statistics_generation_value;
+    (*managed)->statistics = completed_frame_statistics.submit(*frame);
+    (*managed)->statistics_generation = statistics_generation_value;
 
     std::optional<Taskflow_Frame_Trace> captured_trace;
     nlohmann::json captured_components;
@@ -1414,11 +1430,11 @@ void Plot::Private::finalize_retired_frame(Render_Frame* frame) {
     }
 
     auto expected = Frame_State::consuming;
-    if (!managed->state.compare_exchange_strong(
+    if (!(*managed)->state.compare_exchange_strong(
             expected, Frame_State::available, std::memory_order_acq_rel,
             std::memory_order_acquire))
         throw std::logic_error("retired Plot frame is not consuming");
-    latest_statistics_frame.store(managed, std::memory_order_release);
+    latest_statistics_frame.store(managed->get(), std::memory_order_release);
 
     /* 物理槽是唯一背压原因；归还任意槽后只解除一次耗尽状态。 */
     auto admission = Render_Admission_State::frame_slots_exhausted;
@@ -1483,22 +1499,12 @@ void Plot::ensure_started() {
                         .source = Frame_Request_Source::periodic});
                 }
             });
-        /* Scene 回调只表示借用结束；Frame 的发布、统计和复用始终由本帧策略决定。 */
-        if (auto* scene = std::get_if<std::unique_ptr<Scene_2D>>(&d->scene)) {
-            (*scene)->set_frame_callback([weak](Frame_2D* frame) {
-                if (auto owner = weak.lock()) {
-                    try {
-                        owner->d->publish_completed_frame(frame);
-                        owner->d->consume_completed_frame(frame);
-                        owner->d->retire_completed_frame(frame);
-                    }
-                    catch (...) { owner->d->fail(std::current_exception()); }
-                }
-            });
-        } else {
+        /* 3D Scene 的提交/完成回调只表示借用阶段变化；Frame 的发布、
+         * 统计和复用始终由本帧策略决定。2D 回调与每次 render 直接绑定。 */
+        if (std::holds_alternative<std::unique_ptr<Scene_3D>>(d->scene)) {
             auto& scene_3d = std::get<std::unique_ptr<Scene_3D>>(d->scene);
             scene_3d->set_submitted_frame_callback(
-                [weak](Frame_3D*, bool) {
+                [weak](not_null<Frame_3D*>, bool) {
                     if (auto owner = weak.lock()) {
                         try {
                             owner->d->release_render_admission(weak);
@@ -1507,7 +1513,7 @@ void Plot::ensure_started() {
                     }
                 });
             scene_3d->set_frame_callback(
-                [weak](Frame_3D* frame) {
+                [weak](not_null<Frame_3D*> frame) {
                     if (auto owner = weak.lock()) {
                         try {
                             owner->d->publish_completed_frame(frame);
@@ -1518,7 +1524,7 @@ void Plot::ensure_started() {
                     }
                 });
         }
-        /* callback 必须先于周期时钟安装，避免首帧在初始化窗口进入 Scene。 */
+        /* 3D callback 必须先于周期时钟安装，避免首帧在初始化窗口进入 Scene。 */
         d->refresh_schedule();
     });
 }
diff --git a/mcp/core/runtime/Renderable_Adapter.ipp b/mcp/core/runtime/Renderable_Adapter.ipp
index 89addc0..61fdebd 100644
--- a/mcp/core/runtime/Renderable_Adapter.ipp
+++ b/mcp/core/runtime/Renderable_Adapter.ipp
@@ -1,6 +1,7 @@
 #pragma once
 #include <mcp/core/Render_Types.hpp>
 #include <nlohmann/json.hpp>
+#include <ownership.hpp>
 #include <render_2D/plottable/Plottables.hpp>
 #include <render_3D/Render_3D.hpp>
 #include <deque>
@@ -43,13 +44,13 @@ public:
     explicit Renderable_Adapter(Object& value) : object(&value) {}
     void identify(std::string_view id) {
         if constexpr (std::derived_from<Object, aethera::Renderable>)
-            double_buffer::detail::Internal_Access::layer<aethera::Renderable>(object)
+            double_buffer::detail::Internal_Access::layer<aethera::Renderable>(object.get())
                 .diagnostic_component_id = id;
     }
 private:
     template <typename Adapter, typename Field>
     friend struct Renderable_Field_Accessor;
-    Object* object;
+    not_null<Object*> object;
 };
 template <typename Adapter, typename Field>
 struct Renderable_Field_Accessor;
diff --git a/render_2D/render_2D/base/Frame_2D.cpp b/render_2D/render_2D/base/Frame_2D.cpp
index 5221e4f..490dfd1 100644
--- a/render_2D/render_2D/base/Frame_2D.cpp
+++ b/render_2D/render_2D/base/Frame_2D.cpp
@@ -27,9 +27,8 @@ Image_View Frame_2D::image() const { return d->color.view(); }
 Pixel_Buffer Frame_2D::output_pixels() const {
     return d->color.output_pixels(d->output_format);
 }
-Blend2D_Cache& detail::Frame_2D_Access::render_target(Frame_2D* frame) {
-    if (!frame)
-        throw std::invalid_argument("Render_Scene_2D requires a non-null external frame");
+Blend2D_Cache& detail::Frame_2D_Access::render_target(
+    not_null<Frame_2D*> frame) {
     return frame->d->color;
 }
 }
diff --git a/render_2D/render_2D/base/Frame_2D.hpp b/render_2D/render_2D/base/Frame_2D.hpp
index 8c8402e..5b30fa1 100644
--- a/render_2D/render_2D/base/Frame_2D.hpp
+++ b/render_2D/render_2D/base/Frame_2D.hpp
@@ -1,13 +1,15 @@
 #pragma once
 #include "../render/Blend2D_Cache.hpp"
 #include <frame.hpp>
+#include <ownership.hpp>
 #include <array>
 #include <memory>
 namespace aethera::render_2d {
 struct Frame_2D;
 namespace detail {
 struct Frame_2D_Access {
-    [[nodiscard]] static Blend2D_Cache& render_target(Frame_2D* frame);
+    [[nodiscard]] static Blend2D_Cache& render_target(
+        not_null<Frame_2D*> frame);
 };
 }
 struct Frame_2D final : public Render_Frame {
diff --git a/render_2D/render_2D/base/Renderable_2D.ipp b/render_2D/render_2D/base/Renderable_2D.ipp
index 039cb3a..097c9f8 100644
--- a/render_2D/render_2D/base/Renderable_2D.ipp
+++ b/render_2D/render_2D/base/Renderable_2D.ipp
@@ -1,16 +1,17 @@
 #pragma once
+#include <optional>
 #include <stdexcept>
 namespace aethera::render_2d {
 struct Renderable_2D::Private : Prev_Private {
-    using Scene_Attach = std::function<std::expected<void, Dependency_Graph_Error>(Root*)>;
-    using Cache_Access = Blend2D_Cache* (*)(Root*);
-    using Cache_Enabled = bool (*)(const Root*);
-    using Event_Region_Run = Rect_F (*)(const Root*, Size);
+    using Scene_Attach = std::function<std::expected<void, Dependency_Graph_Error>(not_null<Root*>)>;
+    using Cache_Access = not_null<Blend2D_Cache*> (*)(not_null<Root*>);
+    using Cache_Enabled = bool (*)(not_null<const Root*>);
+    using Event_Region_Run = Rect_F (*)(not_null<const Root*>, Size);
     Cache_Access pending_cache{};                              /* 非空时返回最终对象本轮可写的缓存物理对象。 */
     Cache_Enabled cache_enabled{};                            /* 读取最终对象当前发布的运行时缓存策略。 */
     Event_Region_Run event_region_run{};                       /* 计算最终对象当前事件区域的无虚函数入口。 */
-    Blend2D_Cache* paint_target{};                             /* 仅在 Scene Paint 阶段有效的非拥有绘制目标。 */
-    Blend2D_Cache* valid_cache{};                              /* 缓存根最近一次完整重绘产生的权威物理缓存。 */
+    std::optional<not_null<Blend2D_Cache*>> paint_target{};    /* 仅在 Scene Paint 阶段有效的非拥有绘制目标。 */
+    std::optional<not_null<Blend2D_Cache*>> valid_cache{};     /* 缓存根最近一次完整重绘产生的权威物理缓存。 */
     Scene_Attach scene_attach{};                               /* Scene Builder 在构造期执行的所属场景及拓扑绑定。 */
     /* Paint 实现使用：返回 Scene 为本轮指定的目标；未进入 Paint 阶段属于契约错误。 */
     [[nodiscard]] Blend2D_Cache& paint_surface();
@@ -25,7 +26,7 @@ inline bool Renderable_2D::Prop::operator==(const Prop&) const = default;
 inline bool Renderable_2D::State::operator==(const State&) const = default;
 inline Blend2D_Cache& Renderable_2D::Private::paint_surface() {
     if (!paint_target) throw std::logic_error("2D renderable painted without a scene paint target");
-    return *paint_target;
+    return **paint_target;
 }
 inline Rect_F Renderable_2D::Private::event_region(const Attached auto*, Size viewport) const {
     return {0.0, 0.0, static_cast<double>(viewport.width), static_cast<double>(viewport.height)};
@@ -40,17 +41,17 @@ template <Attached Object>
 void Renderable_2D::Private::bind_private_crtp(Object* object) {
     Prev_Private::bind_private_crtp(object);
     double_buffer::detail::Internal_Access::mark_dirty<Render_Graph_Tag>(object);
-    this->event_region_run = [](const Root* root, Size viewport) {
-        const auto* value = static_cast<const Object*>(root);
+    this->event_region_run = [](not_null<const Root*> root, Size viewport) {
+        const auto* value = static_cast<const Object*>(root.get());
         const auto& private_data = double_buffer::detail::Internal_Access::get(value);
         return private_data.event_region(value, viewport);
     };
-    this->pending_cache = [](Root* root) {
-        return &double_buffer::detail::Internal_Access::pending_buffer<Color_Cache>(
-            static_cast<Object*>(root));
+    this->pending_cache = [](not_null<Root*> root) {
+        return not_null{&double_buffer::detail::Internal_Access::pending_buffer<Color_Cache>(
+            static_cast<Object*>(root.get()))};
     };
-    this->cache_enabled = [](const Root* root) {
-        const auto* value = static_cast<const Object*>(root);
+    this->cache_enabled = [](not_null<const Root*> root) {
+        const auto* value = static_cast<const Object*>(root.get());
         const Renderable_2D::Prop& prop =
             double_buffer::detail::Internal_Access::current_prop_layer<Renderable_2D::Base_Tag>(value);
         return prop.cache_enabled;
diff --git a/render_2D/render_2D/base/Types.hpp b/render_2D/render_2D/base/Types.hpp
index eccb7d2..0ed0436 100644
--- a/render_2D/render_2D/base/Types.hpp
+++ b/render_2D/render_2D/base/Types.hpp
@@ -4,6 +4,7 @@
 #include <cmath>
 #include <cstddef>
 #include <cstdint>
+#include <span>
 namespace aethera::render_2d {
 /* 缓存依赖标签；具体字段变化通过该图使缓存拥有者失效。 */
 struct Render_Cache_Tag {};
@@ -151,13 +152,13 @@ struct Pixel_Buffer {
 };
 /* 只读图像像素视图。 */
 struct Image_View {
-    const std::byte* data{}; /* 首行像素地址；不拥有内存。 */
+    std::span<const std::byte> data{}; /* 包含行步长填充的只读像素借用。 */
     int width{}; /* 图像宽度，单位为像素。 */
     int height{}; /* 图像高度，单位为像素。 */
     int stride{}; /* 相邻两行起点的字节距离。 */
     Pixel_Format format{Pixel_Format::bgra8_premultiplied}; /* 像素存储格式。 */
     [[nodiscard]] bool empty() const noexcept {
-        return data == nullptr || width <= 0 || height <= 0;
+        return data.empty() || width <= 0 || height <= 0;
     }
 };
 }
diff --git a/render_2D/render_2D/plottable/Afterglow.hpp b/render_2D/render_2D/plottable/Afterglow.hpp
index 7dddf5e..57000ca 100644
--- a/render_2D/render_2D/plottable/Afterglow.hpp
+++ b/render_2D/render_2D/plottable/Afterglow.hpp
@@ -31,12 +31,13 @@ struct Afterglow : Def<Afterglow, Renderable_2D,
     struct Private;
     template <typename Object> struct Builder : Prev_Builder<Object> {
         using Base = Prev_Builder<Object>;
-        Builder(Frequency_Object* frequency_axis, Power_Object* power_axis,
+        Builder(not_null<Frequency_Object*> frequency_axis,
+                not_null<Power_Object*> power_axis,
                 Plot_Partition_Grid partition_grid = {});
         [[nodiscard]] std::expected<std::unique_ptr<Object>, Dependency_Graph_Error> build();
     private:
-        Frequency_Object* frequency_axis{};                  /* 不拥有的频率轴；生命周期必须覆盖 Afterglow。 */
-        Power_Object* power_axis{};                          /* 不拥有的功率轴；生命周期必须覆盖 Afterglow。 */
+        not_null<Frequency_Object*> frequency_axis;          /* 不拥有的频率轴；生命周期必须覆盖 Afterglow。 */
+        not_null<Power_Object*> power_axis;                  /* 不拥有的功率轴；生命周期必须覆盖 Afterglow。 */
     };
 };
 }
diff --git a/render_2D/render_2D/plottable/Afterglow.ipp b/render_2D/render_2D/plottable/Afterglow.ipp
index 3571db1..370c6db 100644
--- a/render_2D/render_2D/plottable/Afterglow.ipp
+++ b/render_2D/render_2D/plottable/Afterglow.ipp
@@ -1,4 +1,5 @@
 #pragma once
+#include <optional>
 #include "common/Curve_Plot.hpp"
 #include "common/Raster_Plot.hpp"
 #include <iterator>
@@ -14,12 +15,13 @@ struct Afterglow::Private : Prev_Private {
         Plot_Ratio maximum{1.0}; /* 本帧强度归一化分母，最小为 1。 */
         bool valid{}; /* 轴布局和输入数据是否足以生成色块。 */
     };
-    Scene_Object* scene{}; /* 不拥有的所属 Scene。 */
-    Frequency_Object* frequency_axis{}; /* 不拥有的频率轴。 */
-    Power_Object* power_axis{}; /* 不拥有的功率轴。 */
+    std::optional<not_null<Scene_Object*>> scene{}; /* 不拥有的所属 Scene。 */
+    std::optional<not_null<Frequency_Object*>> frequency_axis{}; /* 不拥有的频率轴。 */
+    std::optional<not_null<Power_Object*>> power_axis{}; /* 不拥有的功率轴。 */
     Prepared prepared{}; /* 当前权威状态推导出的 Paint 输入。 */
     Plot_Partition_Grid graph_partition_grid{}; /* Prepare/Paint 子图当前固化的 framebuffer 列×行网格。 */
-    void bind_sources(Frequency_Object* frequency_axis_value, Power_Object* power_axis_value);
+    void bind_sources(not_null<Frequency_Object*> frequency_axis_value,
+                      not_null<Power_Object*> power_axis_value);
     /* CRTP 覆盖：构建累加、归一化和着色三阶段 Prepare 子图。 */
     [[nodiscard]] Task_Graph build_graph(Afterglow* object, const Prop& state);
     [[nodiscard]] bool should_rebuild_graph(Afterglow* object, const Prop& state);
@@ -34,8 +36,8 @@ struct Afterglow::Private : Prev_Private {
 };
 template <typename Object>
 Afterglow::Builder<Object>::Builder(
-    Frequency_Object* frequency_axis_value,
-    Power_Object* power_axis_value,
+    not_null<Frequency_Object*> frequency_axis_value,
+    not_null<Power_Object*> power_axis_value,
     Plot_Partition_Grid partition_grid)
     : Base(), frequency_axis(frequency_axis_value),
       power_axis(power_axis_value) {
@@ -48,24 +50,25 @@ std::expected<std::unique_ptr<Object>, Dependency_Graph_Error> Afterglow::Builde
     auto plot = std::move(result).value();
     auto& private_data = detail::Internal_Access::layer<Object>(plot.get());
     private_data.bind_sources(frequency_axis, power_axis);
-    private_data.scene_attach = [object = plot.get()](Root* root) -> std::expected<void, Dependency_Graph_Error> {
-        auto* scene = static_cast<Scene_Object*>(root);
-        auto& data = detail::Internal_Access::layer<Object>(object);
+    private_data.scene_attach = [object = not_null{plot.get()}](
+        not_null<Root*> root) -> std::expected<void, Dependency_Graph_Error> {
+        const not_null scene{static_cast<Scene_Object*>(root.get())};
+        auto& data = detail::Internal_Access::layer<Object>(object.get());
         data.scene = scene;
-        auto* frequency_axis = data.frequency_axis;
-        auto* power_axis = data.power_axis;
-        return detail::Internal_Access::edit_dependency_graph<Render_Graph_Tag, Render_Cache_Tag>(scene, [&](auto& graph, auto& cache) {
-            graph.add_dependency(frequency_axis, object);
-            graph.add_dependency(power_axis, object);
-            cache.template add_prop_dependency<&Render_Scene_2D::Prop::viewport>(object, scene);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::position>(object, frequency_axis);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::pixel_length>(object, frequency_axis);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::orientation>(object, frequency_axis);
-            cache.template add_prop_dependency<&Numeric_Axis::Prop::coordinate_range>(object, frequency_axis);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::position>(object, power_axis);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::pixel_length>(object, power_axis);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::orientation>(object, power_axis);
-            cache.template add_prop_dependency<&Numeric_Axis::Prop::coordinate_range>(object, power_axis);
+        const auto frequency_axis = data.frequency_axis.value();
+        const auto power_axis = data.power_axis.value();
+        return detail::Internal_Access::edit_dependency_graph<Render_Graph_Tag, Render_Cache_Tag>(scene.get(), [&](auto& graph, auto& cache) {
+            graph.add_dependency(frequency_axis.get(), object.get());
+            graph.add_dependency(power_axis.get(), object.get());
+            cache.template add_prop_dependency<&Render_Scene_2D::Prop::viewport>(object.get(), scene.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::position>(object.get(), frequency_axis.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::pixel_length>(object.get(), frequency_axis.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::orientation>(object.get(), frequency_axis.get());
+            cache.template add_prop_dependency<&Numeric_Axis::Prop::coordinate_range>(object.get(), frequency_axis.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::position>(object.get(), power_axis.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::pixel_length>(object.get(), power_axis.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::orientation>(object.get(), power_axis.get());
+            cache.template add_prop_dependency<&Numeric_Axis::Prop::coordinate_range>(object.get(), power_axis.get());
         });
     };
     return plot;
@@ -115,13 +118,19 @@ inline void Afterglow::Private::prepare_frame(Afterglow* object) {
             prepared.source_spectra.assign(spectra.begin(), spectra.end());
         });
     detail::Internal_Access::accumulate_stream<Afterglow_Stream_Tag>(object, std::size_t{64});
-    const auto& frequency_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(frequency_axis);
-    const auto& power_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(power_axis);
+    const auto& frequency_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(
+        frequency_axis.value().get());
+    const auto& power_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(
+        power_axis.value().get());
     const std::size_t available = prepared.source_spectra.empty() ? 0 : prepared.source_spectra.back()->size();
     const int columns = static_cast<int>(state.frequency_point_size ? std::min(state.frequency_point_size, available) : available);
     const int rows = static_cast<int>(state.power_point_size ? state.power_point_size : std::max<Axis_Pixel_Length>(1.0, std::abs(power_layout.pixel_length)));
-    const Size canvas = this->template read_current_prop<Render_Scene_2D::Base_Tag>(scene).viewport;
-    const auto layout = detail::raster_layout(frequency_axis, state.frequency_range, columns, power_axis, state.power_range, rows, frequency_layout.orientation, power_layout.orientation);
+    const Size canvas = this->template read_current_prop<Render_Scene_2D::Base_Tag>(
+        scene.value().get()).viewport;
+    const auto layout = detail::raster_layout(
+        frequency_axis.value().get(), state.frequency_range, columns,
+        power_axis.value().get(), state.power_range, rows,
+        frequency_layout.orientation, power_layout.orientation);
     if (canvas.empty() || !layout.valid()) {
         prepared.valid = false;
         return;
@@ -239,7 +248,9 @@ void Afterglow::Private::after_prop_set(Object* object,
         detail::Internal_Access::mark_dirty<Render_Graph_Tag>(object);
     }
 }
-inline void Afterglow::Private::bind_sources(Frequency_Object* frequency_axis_value, Power_Object* power_axis_value) {
+inline void Afterglow::Private::bind_sources(
+    not_null<Frequency_Object*> frequency_axis_value,
+    not_null<Power_Object*> power_axis_value) {
     frequency_axis = frequency_axis_value;
     power_axis = power_axis_value;
 }
diff --git a/render_2D/render_2D/plottable/Constellation_Diagram.hpp b/render_2D/render_2D/plottable/Constellation_Diagram.hpp
index 125d3b8..429ba1e 100644
--- a/render_2D/render_2D/plottable/Constellation_Diagram.hpp
+++ b/render_2D/render_2D/plottable/Constellation_Diagram.hpp
@@ -37,12 +37,13 @@ struct Constellation_Diagram : Def<Constellation_Diagram,
     template <typename Object>
     struct Builder : Prev_Builder<Object> {
         using Base = Prev_Builder<Object>;
-        Builder(Axis_Object* i_axis, Axis_Object* q_axis,
+        Builder(not_null<Axis_Object*> i_axis,
+                not_null<Axis_Object*> q_axis,
                 Plot_Partition_Count partition_count = 1);
         [[nodiscard]] std::expected<std::unique_ptr<Object>, Dependency_Graph_Error> build();
     private:
-        Axis_Object* i_axis{}; /* 不拥有的同相分量轴；生命周期必须覆盖星座图。 */
-        Axis_Object* q_axis{}; /* 不拥有的正交分量轴；生命周期必须覆盖星座图。 */
+        not_null<Axis_Object*> i_axis; /* 不拥有的同相分量轴；生命周期必须覆盖星座图。 */
+        not_null<Axis_Object*> q_axis; /* 不拥有的正交分量轴；生命周期必须覆盖星座图。 */
     };
 };
 }
diff --git a/render_2D/render_2D/plottable/Constellation_Diagram.ipp b/render_2D/render_2D/plottable/Constellation_Diagram.ipp
index 8d9b934..13fe753 100644
--- a/render_2D/render_2D/plottable/Constellation_Diagram.ipp
+++ b/render_2D/render_2D/plottable/Constellation_Diagram.ipp
@@ -1,4 +1,5 @@
 #pragma once
+#include <optional>
 #include "common/Curve_Plot.hpp"
 #include <algorithm>
 #include <numbers>
@@ -10,11 +11,12 @@ struct Constellation_Diagram::Private : Prev_Private {
         Size canvas{}; /* 当前 Scene viewport 的像素尺寸。 */
         bool valid{}; /* 两根轴是否正交且画布有效。 */
     };
-    Scene_Object* scene{}; /* 不拥有的所属 Scene。 */
-    Axis_Object* i_axis{}; /* 不拥有的同相分量轴。 */
-    Axis_Object* q_axis{}; /* 不拥有的正交分量轴。 */
+    std::optional<not_null<Scene_Object*>> scene{}; /* 不拥有的所属 Scene。 */
+    std::optional<not_null<Axis_Object*>> i_axis{}; /* 不拥有的同相分量轴。 */
+    std::optional<not_null<Axis_Object*>> q_axis{}; /* 不拥有的正交分量轴。 */
     Prepared prepared{}; /* 当前权威状态推导出的 Paint 输入。 */
-    void bind_sources(Axis_Object* i_axis_value, Axis_Object* q_axis_value);
+    void bind_sources(not_null<Axis_Object*> i_axis_value,
+                      not_null<Axis_Object*> q_axis_value);
     /* CRTP 覆盖：从当前点集和轴状态准备画布坐标。 */
     void prepare_data(Constellation_Diagram* object);
     /* CRTP 覆盖：构建锚点前驱与并行接收点 Paint 子图。 */
@@ -32,7 +34,8 @@ struct Constellation_Diagram::Private : Prev_Private {
 };
 template <typename Object>
 Constellation_Diagram::Builder<Object>::Builder(
-    Axis_Object* i_axis_value, Axis_Object* q_axis_value,
+    not_null<Axis_Object*> i_axis_value,
+    not_null<Axis_Object*> q_axis_value,
     Plot_Partition_Count partition_count) : Base(), i_axis(i_axis_value), q_axis(q_axis_value) {
     this->prop.partition_count = partition_count;
 }
@@ -43,24 +46,25 @@ std::expected<std::unique_ptr<Object>, Dependency_Graph_Error> Constellation_Dia
     auto plot = std::move(result).value();
     auto& private_data = detail::Internal_Access::layer<Object>(plot.get());
     private_data.bind_sources(i_axis, q_axis);
-    private_data.scene_attach = [object = plot.get()](Root* root) -> std::expected<void, Dependency_Graph_Error> {
-        auto* scene = static_cast<Scene_Object*>(root);
-        auto& data = detail::Internal_Access::layer<Object>(object);
+    private_data.scene_attach = [object = not_null{plot.get()}](
+        not_null<Root*> root) -> std::expected<void, Dependency_Graph_Error> {
+        const not_null scene{static_cast<Scene_Object*>(root.get())};
+        auto& data = detail::Internal_Access::layer<Object>(object.get());
         data.scene = scene;
-        auto* i_axis = data.i_axis;
-        auto* q_axis = data.q_axis;
-        return detail::Internal_Access::edit_dependency_graph<Render_Graph_Tag, Render_Cache_Tag>(scene, [&](auto& graph, auto& cache) {
-            graph.add_dependency(i_axis, object);
-            graph.add_dependency(q_axis, object);
-            cache.template add_prop_dependency<&Render_Scene_2D::Prop::viewport>(object, scene);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::position>(object, i_axis);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::pixel_length>(object, i_axis);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::orientation>(object, i_axis);
-            cache.template add_prop_dependency<&Numeric_Axis::Prop::coordinate_range>(object, i_axis);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::position>(object, q_axis);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::pixel_length>(object, q_axis);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::orientation>(object, q_axis);
-            cache.template add_prop_dependency<&Numeric_Axis::Prop::coordinate_range>(object, q_axis);
+        const auto i_axis = data.i_axis.value();
+        const auto q_axis = data.q_axis.value();
+        return detail::Internal_Access::edit_dependency_graph<Render_Graph_Tag, Render_Cache_Tag>(scene.get(), [&](auto& graph, auto& cache) {
+            graph.add_dependency(i_axis.get(), object.get());
+            graph.add_dependency(q_axis.get(), object.get());
+            cache.template add_prop_dependency<&Render_Scene_2D::Prop::viewport>(object.get(), scene.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::position>(object.get(), i_axis.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::pixel_length>(object.get(), i_axis.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::orientation>(object.get(), i_axis.get());
+            cache.template add_prop_dependency<&Numeric_Axis::Prop::coordinate_range>(object.get(), i_axis.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::position>(object.get(), q_axis.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::pixel_length>(object.get(), q_axis.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::orientation>(object.get(), q_axis.get());
+            cache.template add_prop_dependency<&Numeric_Axis::Prop::coordinate_range>(object.get(), q_axis.get());
         });
     };
     return plot;
@@ -73,10 +77,13 @@ inline void Constellation_Diagram::Private::prepare_data(Constellation_Diagram*
         [&](const Constellation_Point& point) {
             return current - point.submitted_at_ms <= state.point_lifetime_ms;
         });
-    const auto& i_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(i_axis);
-    const auto& q_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(q_axis);
+    const auto& i_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(
+        i_axis.value().get());
+    const auto& q_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(
+        q_axis.value().get());
     prepared = {};
-    prepared.canvas = this->template read_current_prop<Render_Scene_2D::Base_Tag>(scene).viewport;
+    prepared.canvas = this->template read_current_prop<Render_Scene_2D::Base_Tag>(
+        scene.value().get()).viewport;
     if (prepared.canvas.empty() || i_layout.orientation == q_layout.orientation) {
         return;
     }
@@ -85,7 +92,9 @@ inline void Constellation_Diagram::Private::prepare_data(Constellation_Diagram*
             for (const auto& value : points)
                 if (current - value.submitted_at_ms <= state.point_lifetime_ms)
                     prepared.points.push_back(detail::map_plot_point(
-                        i_axis, value.point.x, q_axis, value.point.y, i_layout.orientation));
+                        i_axis.value().get(), value.point.x,
+                        q_axis.value().get(), value.point.y,
+                        i_layout.orientation));
         });
     const int count = static_cast<int>(state.type);
     const Plot_Coordinate center_i = state.i_range.center();
@@ -93,7 +102,10 @@ inline void Constellation_Diagram::Private::prepare_data(Constellation_Diagram*
     const Plot_Coordinate radius = std::min(state.i_range.size(), state.q_range.size()) * 0.4;
     for (int index = 0; index < count; ++index) {
         const Plot_Ratio angle = state.phase_offset_radians + 2.0 * std::numbers::pi * index / count;
-        prepared.anchors.push_back(detail::map_plot_point(i_axis, center_i + std::cos(angle) * radius, q_axis, center_q + std::sin(angle) * radius, i_layout.orientation));
+        prepared.anchors.push_back(detail::map_plot_point(
+            i_axis.value().get(), center_i + std::cos(angle) * radius,
+            q_axis.value().get(), center_q + std::sin(angle) * radius,
+            i_layout.orientation));
     }
     prepared.valid = true;
     detail::Internal_Access::mark_dirty<Render_Graph_Tag>(object);
@@ -191,7 +203,9 @@ void Constellation_Diagram::Private::after_prop_set(
         detail::Internal_Access::mark_dirty<Render_Graph_Tag>(object);
     }
 }
-inline void Constellation_Diagram::Private::bind_sources(Axis_Object* i_axis_value, Axis_Object* q_axis_value) {
+inline void Constellation_Diagram::Private::bind_sources(
+    not_null<Axis_Object*> i_axis_value,
+    not_null<Axis_Object*> q_axis_value) {
     i_axis = i_axis_value;
     q_axis = q_axis_value;
 }
diff --git a/render_2D/render_2D/plottable/Frequency_Trace.hpp b/render_2D/render_2D/plottable/Frequency_Trace.hpp
index e609685..6b44f1c 100644
--- a/render_2D/render_2D/plottable/Frequency_Trace.hpp
+++ b/render_2D/render_2D/plottable/Frequency_Trace.hpp
@@ -30,12 +30,13 @@ struct Frequency_Trace : Def<Frequency_Trace, Renderable_2D,
     template <typename Object>
     struct Builder : Prev_Builder<Object> {
         using Base = Prev_Builder<Object>;
-        Builder(Time_Object* time_axis, Value_Object* value_axis,
+        Builder(not_null<Time_Object*> time_axis,
+                not_null<Value_Object*> value_axis,
                 Plot_Partition_Count partition_count = 1);
         [[nodiscard]] std::expected<std::unique_ptr<Object>, Dependency_Graph_Error> build();
     private:
-        Time_Object* time_axis{};                            /* 不拥有的时间轴。 */
-        Value_Object* value_axis{};                          /* 不拥有的数值轴。 */
+        not_null<Time_Object*> time_axis;                    /* 不拥有的时间轴。 */
+        not_null<Value_Object*> value_axis;                  /* 不拥有的数值轴。 */
     };
 };
 }
diff --git a/render_2D/render_2D/plottable/Frequency_Trace.ipp b/render_2D/render_2D/plottable/Frequency_Trace.ipp
index d07cd54..880acc3 100644
--- a/render_2D/render_2D/plottable/Frequency_Trace.ipp
+++ b/render_2D/render_2D/plottable/Frequency_Trace.ipp
@@ -1,4 +1,5 @@
 #pragma once
+#include <optional>
 #include "common/Curve_Plot.hpp"
 namespace aethera::render_2d {
 struct Frequency_Trace::Private : Prev_Private {
@@ -8,12 +9,13 @@ struct Frequency_Trace::Private : Prev_Private {
         Size canvas{};                                       /* 当前颜色层尺寸。 */
         bool valid{};                                        /* 两根轴正交且画布有效。 */
     };
-    Scene_Object* scene{};                                   /* 不拥有的所属 Scene。 */
-    Time_Object* time_axis{};                                /* 不拥有的时间轴。 */
-    Value_Object* value_axis{};                              /* 不拥有的数值轴。 */
+    std::optional<not_null<Scene_Object*>> scene{};           /* 不拥有的所属 Scene。 */
+    std::optional<not_null<Time_Object*>> time_axis{};        /* 不拥有的时间轴。 */
+    std::optional<not_null<Value_Object*>> value_axis{};      /* 不拥有的数值轴。 */
     Prepared prepared{};                                     /* 当前状态和轴状态推导出的 Paint 输入。 */
     Plot_Partition_Count graph_partition_count{};            /* 当前 Prepare 子图固化的分块数。 */
-    void bind_sources(Time_Object* time_axis_value, Value_Object* value_axis_value);
+    void bind_sources(not_null<Time_Object*> time_axis_value,
+                      not_null<Value_Object*> value_axis_value);
     /* CRTP 覆盖：按当前样本规模构建分块 Prepare 子图。 */
     [[nodiscard]] Task_Graph build_graph(Frequency_Trace* object, const Prop& state);
     [[nodiscard]] bool should_rebuild_graph(Frequency_Trace* object, const Prop& state);
@@ -25,15 +27,57 @@ struct Frequency_Trace::Private : Prev_Private {
 };
 template <typename Object>
 Frequency_Trace::Builder<Object>::Builder(
-    Time_Object* time_axis_value, Value_Object* value_axis_value,
+    not_null<Time_Object*> time_axis_value,
+    not_null<Value_Object*> value_axis_value,
     Plot_Partition_Count partition_count)
     : Base(), time_axis(time_axis_value), value_axis(value_axis_value) {
     this->prop.partition_count = partition_count;
 }
 template <typename Object>
 std::expected<std::unique_ptr<Object>, Dependency_Graph_Error> Frequency_Trace::Builder<Object>::build() {
-    auto result = Base::build(); if (!result) return std::unexpected(result.error()); auto trace = std::move(result).value(); auto& private_data = detail::Internal_Access::get(trace.get()); private_data.bind_sources(time_axis, value_axis);
-    private_data.scene_attach = [object = trace.get()](Root* root) -> std::expected<void, Dependency_Graph_Error> { auto* scene = static_cast<Scene_Object*>(root); auto& data = detail::Internal_Access::get(object); data.scene = scene; auto* time_axis = data.time_axis; auto* value_axis = data.value_axis; return detail::Internal_Access::edit_dependency_graph<Render_Graph_Tag, Render_Cache_Tag>(scene, [&](auto& graph, auto& cache) { graph.add_dependency(time_axis, object); graph.add_dependency(value_axis, object); cache.template add_prop_dependency<&Render_Scene_2D::Prop::viewport>(object, scene); cache.template add_prop_dependency<&Abs_Axis::Prop::position>(object, time_axis); cache.template add_prop_dependency<&Abs_Axis::Prop::pixel_length>(object, time_axis); cache.template add_prop_dependency<&Abs_Axis::Prop::orientation>(object, time_axis); cache.template add_prop_dependency<&Time_Axis::Prop::visible_count>(object, time_axis); cache.template add_prop_dependency<&Time_Axis::Prop::newest_at_start>(object, time_axis); cache.template add_dependency<&Time_Axis::State::next_tick>(object, time_axis); cache.template add_prop_dependency<&Abs_Axis::Prop::position>(object, value_axis); cache.template add_prop_dependency<&Abs_Axis::Prop::pixel_length>(object, value_axis); cache.template add_prop_dependency<&Abs_Axis::Prop::orientation>(object, value_axis); cache.template add_prop_dependency<&Numeric_Axis::Prop::coordinate_range>(object, value_axis); }); }; return trace;
+    auto result = Base::build();
+    if (!result) return std::unexpected(result.error());
+    auto trace = std::move(result).value();
+    const not_null object{trace.get()};
+    auto& private_data = detail::Internal_Access::get(object.get());
+    private_data.bind_sources(time_axis, value_axis);
+    private_data.scene_attach = [object](not_null<Root*> root)
+        -> std::expected<void, Dependency_Graph_Error> {
+        const not_null scene{static_cast<Scene_Object*>(root.get())};
+        auto& data = detail::Internal_Access::get(object.get());
+        data.scene = scene;
+        const auto time = data.time_axis.value();
+        const auto value = data.value_axis.value();
+        return detail::Internal_Access::edit_dependency_graph<
+            Render_Graph_Tag, Render_Cache_Tag>(
+            scene.get(), [&](auto& graph, auto& cache) {
+                graph.add_dependency(time.get(), object.get());
+                graph.add_dependency(value.get(), object.get());
+                cache.template add_prop_dependency<
+                    &Render_Scene_2D::Prop::viewport>(object.get(), scene.get());
+                cache.template add_prop_dependency<
+                    &Abs_Axis::Prop::position>(object.get(), time.get());
+                cache.template add_prop_dependency<
+                    &Abs_Axis::Prop::pixel_length>(object.get(), time.get());
+                cache.template add_prop_dependency<
+                    &Abs_Axis::Prop::orientation>(object.get(), time.get());
+                cache.template add_prop_dependency<
+                    &Time_Axis::Prop::visible_count>(object.get(), time.get());
+                cache.template add_prop_dependency<
+                    &Time_Axis::Prop::newest_at_start>(object.get(), time.get());
+                cache.template add_dependency<&Time_Axis::State::next_tick>(
+                    object.get(), time.get());
+                cache.template add_prop_dependency<
+                    &Abs_Axis::Prop::position>(object.get(), value.get());
+                cache.template add_prop_dependency<
+                    &Abs_Axis::Prop::pixel_length>(object.get(), value.get());
+                cache.template add_prop_dependency<
+                    &Abs_Axis::Prop::orientation>(object.get(), value.get());
+                cache.template add_prop_dependency<
+                    &Numeric_Axis::Prop::coordinate_range>(object.get(), value.get());
+            });
+    };
+    return trace;
 }
 inline bool Frequency_Trace::Private::should_rebuild_graph(Frequency_Trace*, const Prop& state) { return graph_partition_count != state.partition_count; }
 inline Task_Graph Frequency_Trace::Private::build_graph(Frequency_Trace* object, const Prop& state) {
@@ -50,15 +94,20 @@ inline Task_Graph Frequency_Trace::Private::build_graph(Frequency_Trace* object,
 }
 inline void Frequency_Trace::Private::prepare_frame(Frequency_Trace* object, Plot_Partition_Count partition_count) {
     const auto& state = static_cast<const Prop&>(detail::Internal_Access::current_prop(object));
-    const auto& time_layout = static_cast<const Abs_Axis::Prop&>(detail::Internal_Access::current_prop(time_axis));
-    const auto& value_layout = static_cast<const Abs_Axis::Prop&>(detail::Internal_Access::current_prop(value_axis));
+    const auto& time_layout = static_cast<const Abs_Axis::Prop&>(
+        detail::Internal_Access::current_prop(time_axis.value().get()));
+    const auto& value_layout = static_cast<const Abs_Axis::Prop&>(
+        detail::Internal_Access::current_prop(value_axis.value().get()));
     const auto visible_count = static_cast<std::size_t>(std::max<Axis_Visible_Count>(
-        2, static_cast<const Time_Axis::Prop&>(detail::Internal_Access::current_prop(time_axis)).visible_count));
+        2, static_cast<const Time_Axis::Prop&>(
+               detail::Internal_Access::current_prop(
+                   time_axis.value().get())).visible_count));
     detail::Internal_Access::exchange_stream<Frequency_Trace_Stream_Tag>(object);
     detail::Internal_Access::accumulate_stream<Frequency_Trace_Stream_Tag>(object, visible_count);
     prepared = {};
     prepared.partitions.resize(partition_count);
-    prepared.canvas = static_cast<const Render_Scene_2D::Prop&>(detail::Internal_Access::current_prop(scene)).viewport;
+    prepared.canvas = static_cast<const Render_Scene_2D::Prop&>(
+        detail::Internal_Access::current_prop(scene.value().get())).viewport;
     if (prepared.canvas.empty() || time_layout.orientation == value_layout.orientation) return;
     detail::Internal_Access::access_rendering_stream<Frequency_Trace_Stream_Tag>(object, [&](std::span<Frequency_Trace_Sample> samples) {
         prepared.samples.reserve(samples.size());
@@ -70,12 +119,21 @@ inline void Frequency_Trace::Private::prepare_frame(Frequency_Trace* object, Plo
 inline void Frequency_Trace::Private::prepare_partition(Frequency_Trace* object, Plot_Partition_Count partition_index) {
     if (!prepared.valid) return;
     const auto& state = static_cast<const Prop&>(detail::Internal_Access::current_prop(object));
-    const auto& time_layout = static_cast<const Abs_Axis::Prop&>(detail::Internal_Access::current_prop(time_axis));
-    const auto& value_layout = static_cast<const Abs_Axis::Prop&>(detail::Internal_Access::current_prop(value_axis));
-    const auto& value_state = static_cast<const Numeric_Axis::Prop&>(detail::Internal_Access::current_prop(value_axis));
+    const auto& time_layout = static_cast<const Abs_Axis::Prop&>(
+        detail::Internal_Access::current_prop(time_axis.value().get()));
+    const auto& value_layout = static_cast<const Abs_Axis::Prop&>(
+        detail::Internal_Access::current_prop(value_axis.value().get()));
+    const auto& value_state = static_cast<const Numeric_Axis::Prop&>(
+        detail::Internal_Access::current_prop(value_axis.value().get()));
     const Axis_Range domain{prepared.samples.front().coordinate, prepared.samples.back().coordinate}; const auto range = detail::curve_partition_range(prepared.samples.size(), partition_index, prepared.partitions.size(), domain);
-    const Axis_Range visible_range = detail::Internal_Access::layer<Abs_Axis>(time_axis).runtime_coordinate_range();
-    prepared.partitions[partition_index] = detail::prepare_curve(std::span<const detail::Curve_Sample>(prepared.samples).subspan(range.first_sample, range.sample_count), true, visible_range, value_state.coordinate_range, time_axis, value_axis, time_layout.orientation, value_layout.orientation);
+    const Axis_Range visible_range = detail::Internal_Access::layer<Abs_Axis>(
+        time_axis.value().get()).runtime_coordinate_range();
+    prepared.partitions[partition_index] = detail::prepare_curve(
+        std::span<const detail::Curve_Sample>(prepared.samples).subspan(
+            range.first_sample, range.sample_count),
+        true, visible_range, value_state.coordinate_range,
+        time_axis.value().get(), value_axis.value().get(),
+        time_layout.orientation, value_layout.orientation);
 }
 inline void Frequency_Trace::Private::paint_partition(Frequency_Trace* object, Plot_Partition_Count partition_index) {
     if (!prepared.valid || partition_index >= prepared.partitions.size()) return;
@@ -93,5 +151,10 @@ void Frequency_Trace::Private::after_prop_set(
         detail::Internal_Access::mark_dirty<Render_Graph_Tag>(object);
     }
 }
-inline void Frequency_Trace::Private::bind_sources(Time_Object* time_axis_value, Value_Object* value_axis_value) { time_axis = time_axis_value; value_axis = value_axis_value; }
+inline void Frequency_Trace::Private::bind_sources(
+    not_null<Time_Object*> time_axis_value,
+    not_null<Value_Object*> value_axis_value) {
+    time_axis = time_axis_value;
+    value_axis = value_axis_value;
+}
 }
diff --git a/render_2D/render_2D/plottable/Selection_Rectangle_Overlay.cpp b/render_2D/render_2D/plottable/Selection_Rectangle_Overlay.cpp
index cb85bf0..6271ddb 100644
--- a/render_2D/render_2D/plottable/Selection_Rectangle_Overlay.cpp
+++ b/render_2D/render_2D/plottable/Selection_Rectangle_Overlay.cpp
@@ -12,8 +12,9 @@ Axis_Rectangle Selection_Rectangle_Overlay::Private::axis_rectangle(Axis_Point f
 }
 std::string Selection_Rectangle_Overlay::Private::range_label(const Axis_Source& axis, Axis_Range range) {
     const auto coordinate_label = [&axis](Axis_Coordinate coordinate) {
-        auto label = std::visit([coordinate](const auto* value) {
-            return double_buffer::detail::Internal_Access::layer<Abs_Axis>(value)
+        auto label = std::visit([coordinate](const auto value) {
+            return double_buffer::detail::Internal_Access::layer<Abs_Axis>(
+                value.get())
                 .runtime_tick_label(coordinate);
         }, axis);
         if (!label.empty()) return label;
@@ -24,20 +25,23 @@ std::string Selection_Rectangle_Overlay::Private::range_label(const Axis_Source&
     return coordinate_label(range.origin) + " .. " + coordinate_label(range.target);
 }
 Axis_Range Selection_Rectangle_Overlay::Private::coordinate_range(const Axis_Source& axis) {
-    return std::visit([](const auto* value) {
-        return double_buffer::detail::Internal_Access::layer<Abs_Axis>(value)
+    return std::visit([](const auto value) {
+        return double_buffer::detail::Internal_Access::layer<Abs_Axis>(
+            value.get())
             .runtime_coordinate_range();
     }, axis);
 }
 double Selection_Rectangle_Overlay::Private::coordinate_to_pixel(const Axis_Source& axis, double coordinate) {
-    return std::visit([coordinate](const auto* value) {
-        return double_buffer::detail::Internal_Access::layer<Abs_Axis>(value)
+    return std::visit([coordinate](const auto value) {
+        return double_buffer::detail::Internal_Access::layer<Abs_Axis>(
+            value.get())
             .runtime_coordinate_to_pixel(coordinate);
     }, axis);
 }
 double Selection_Rectangle_Overlay::Private::point_to_coordinate(const Axis_Source& axis, Point_F point) {
-    return std::visit([point](const auto* value) {
-        return double_buffer::detail::Internal_Access::layer<Abs_Axis>(value)
+    return std::visit([point](const auto value) {
+        return double_buffer::detail::Internal_Access::layer<Abs_Axis>(
+            value.get())
             .runtime_point_to_coordinate(point);
     }, axis);
 }
@@ -45,9 +49,10 @@ Rect_F Selection_Rectangle_Overlay::Private::map_rect(const Axis_Source& horizon
                                                        Axis_Range horizontal_range,
                                                        const Axis_Source& vertical,
                                                        Axis_Range vertical_range) {
-    return std::visit([&](const auto* horizontal_value, const auto* vertical_value) {
-        return detail::map_plot_rect(horizontal_value, horizontal_range,
-                                     vertical_value, vertical_range,
+    return std::visit([&](const auto horizontal_value,
+                          const auto vertical_value) {
+        return detail::map_plot_rect(horizontal_value.get(), horizontal_range,
+                                     vertical_value.get(), vertical_range,
                                      Axis_Orientation::horizontal);
     }, horizontal, vertical);
 }
diff --git a/render_2D/render_2D/plottable/Selection_Rectangle_Overlay.hpp b/render_2D/render_2D/plottable/Selection_Rectangle_Overlay.hpp
index 3d1c550..fc01e26 100644
--- a/render_2D/render_2D/plottable/Selection_Rectangle_Overlay.hpp
+++ b/render_2D/render_2D/plottable/Selection_Rectangle_Overlay.hpp
@@ -31,10 +31,11 @@ struct Selection_Rectangle_Overlay : Def<Selection_Rectangle_Overlay, Renderable
     struct Builder : Prev_Builder<Object> {
         using Base = Prev_Builder<Object>;
         template <Axis_Object Horizontal_Axis, Axis_Object Vertical_Axis>
-        Builder(Horizontal_Axis* horizontal_axis, Vertical_Axis* vertical_axis);
+        Builder(not_null<Horizontal_Axis*> horizontal_axis,
+                not_null<Vertical_Axis*> vertical_axis);
         [[nodiscard]] std::expected<std::unique_ptr<Object>, Dependency_Graph_Error> build();
     private:
-        std::function<void(Object*)> initialize{};                    /* build 成功后绑定两根最终轴及其 Scene 拓扑。 */
+        std::function<void(not_null<Object*>)> initialize{};          /* build 成功后绑定两根最终轴及其 Scene 拓扑。 */
     };
 };
 }
diff --git a/render_2D/render_2D/plottable/Selection_Rectangle_Overlay.ipp b/render_2D/render_2D/plottable/Selection_Rectangle_Overlay.ipp
index e069099..7101bb2 100644
--- a/render_2D/render_2D/plottable/Selection_Rectangle_Overlay.ipp
+++ b/render_2D/render_2D/plottable/Selection_Rectangle_Overlay.ipp
@@ -2,20 +2,23 @@
 #include "common/Curve_Plot.hpp"
 #include <algorithm>
 #include <cmath>
+#include <optional>
 #include <stdexcept>
 namespace aethera::render_2d {
 struct Selection_Rectangle_Overlay::Private : Prev_Private {
-    using Axis_Source = std::variant<Numeric_Axis_Object*, Frequency_Axis_Object*, Time_Axis_Object*>;
-    Scene_Object* scene{};                                   /* 不拥有的所属 Scene。 */
-    Axis_Source horizontal_axis{};                           /* 保留最终类型的水平坐标轴。 */
-    Axis_Source vertical_axis{};                             /* 保留最终类型的垂直坐标轴。 */
+    using Axis_Source = std::variant<not_null<Numeric_Axis_Object*>,
+        not_null<Frequency_Axis_Object*>, not_null<Time_Axis_Object*>>;
+    std::optional<not_null<Scene_Object*>> scene{};           /* 不拥有的所属 Scene。 */
+    std::optional<Axis_Source> horizontal_axis{};             /* 保留最终类型的水平坐标轴。 */
+    std::optional<Axis_Source> vertical_axis{};               /* 保留最终类型的垂直坐标轴。 */
     Axis_Point drag_origin{};                                /* 当前拖动起点的两轴数据坐标。 */
     Axis_Point drag_current{};                               /* 当前拖动终点的两轴数据坐标。 */
     Point_F press_position{};                                /* 仅用于区分点击与拖动的按下像素位置。 */
     bool dragging{};                                         /* 是否正在构造尚未提交的选择矩形。 */
     static constexpr double minimum_drag_distance_pixels{3.0}; /* 允许提交和绘制选择框的最小像素距离。 */
     template <typename Horizontal_Axis, typename Vertical_Axis>
-    void bind_sources(Horizontal_Axis* horizontal_axis_value, Vertical_Axis* vertical_axis_value);
+    void bind_sources(not_null<Horizontal_Axis*> horizontal_axis_value,
+                      not_null<Vertical_Axis*> vertical_axis_value);
     [[nodiscard]] static Axis_Rectangle axis_rectangle(Axis_Point first, Axis_Point second);
     [[nodiscard]] static std::string range_label(const Axis_Source& axis, Axis_Range range);
     [[nodiscard]] static Axis_Range coordinate_range(const Axis_Source& axis);
@@ -36,7 +39,9 @@ struct Selection_Rectangle_Overlay::Private : Prev_Private {
 };
 template <typename Object>
 template <Axis_Object Horizontal_Axis, Axis_Object Vertical_Axis>
-Selection_Rectangle_Overlay::Builder<Object>::Builder(Horizontal_Axis* horizontal_axis, Vertical_Axis* vertical_axis) : Base() {
+Selection_Rectangle_Overlay::Builder<Object>::Builder(
+    not_null<Horizontal_Axis*> horizontal_axis,
+    not_null<Vertical_Axis*> vertical_axis) : Base() {
     static_assert((std::same_as<Horizontal_Axis, Numeric_Axis_Object> ||
                    std::same_as<Horizontal_Axis, Frequency_Axis_Object> ||
                    std::same_as<Horizontal_Axis, Time_Axis_Object>) &&
@@ -44,19 +49,20 @@ Selection_Rectangle_Overlay::Builder<Object>::Builder(Horizontal_Axis* horizonta
                    std::same_as<Vertical_Axis, Frequency_Axis_Object> ||
                    std::same_as<Vertical_Axis, Time_Axis_Object>),
                   "selection rectangle axes must preserve one of the supported final axis types");
-    if (!horizontal_axis || !vertical_axis) throw std::invalid_argument("selection rectangle requires two axes");
-    initialize = [horizontal_axis, vertical_axis](Object* overlay) {
-        auto& private_data = detail::Internal_Access::layer<Object>(overlay);
+    initialize = [horizontal_axis, vertical_axis](not_null<Object*> overlay) {
+        auto& private_data = detail::Internal_Access::layer<Object>(overlay.get());
         private_data.bind_sources(horizontal_axis, vertical_axis);
-        private_data.scene_attach = [object = overlay, horizontal_axis, vertical_axis](Root* root) -> std::expected<void, Dependency_Graph_Error> {
-            auto* scene = static_cast<Scene_Object*>(root);
-            auto& data = detail::Internal_Access::layer<Object>(object);
+        private_data.scene_attach = [object = overlay, horizontal_axis,
+            vertical_axis](not_null<Root*> root)
+            -> std::expected<void, Dependency_Graph_Error> {
+            const not_null scene{static_cast<Scene_Object*>(root.get())};
+            auto& data = detail::Internal_Access::layer<Object>(object.get());
             data.scene = scene;
-            return detail::Internal_Access::edit_dependency_graph<Render_Graph_Tag, Render_Cache_Tag>(scene, [&](auto& graph, auto& cache) {
-                graph.add_dependency(horizontal_axis, object);
-                graph.add_dependency(vertical_axis, object);
-                cache.template add_prop_dependency<&Render_Scene_2D::Prop::viewport>(object, scene);
-                const auto bind_axis = [&]<Axis_Object Axis>(Axis* axis) { cache.template add_prop_dependency<&Abs_Axis::Prop::position>(object, axis); cache.template add_prop_dependency<&Abs_Axis::Prop::pixel_length>(object, axis); cache.template add_prop_dependency<&Abs_Axis::Prop::orientation>(object, axis); if constexpr (std::derived_from<Axis, Numeric_Axis>) { cache.template add_prop_dependency<&Numeric_Axis::Prop::coordinate_range>(object, axis); cache.template add_prop_dependency<&Numeric_Axis::Prop::precision>(object, axis); cache.template add_prop_dependency<&Numeric_Axis::Prop::locale>(object, axis); } else if constexpr (std::derived_from<Axis, Time_Axis>) { cache.template add_prop_dependency<&Time_Axis::Prop::visible_count>(object, axis); cache.template add_prop_dependency<&Time_Axis::Prop::newest_at_start>(object, axis); cache.template add_prop_dependency<&Time_Axis::Prop::format>(object, axis); cache.template add_dependency<&Time_Axis::State::next_tick>(object, axis); } };
+            return detail::Internal_Access::edit_dependency_graph<Render_Graph_Tag, Render_Cache_Tag>(scene.get(), [&](auto& graph, auto& cache) {
+                graph.add_dependency(horizontal_axis.get(), object.get());
+                graph.add_dependency(vertical_axis.get(), object.get());
+                cache.template add_prop_dependency<&Render_Scene_2D::Prop::viewport>(object.get(), scene.get());
+                const auto bind_axis = [&]<Axis_Object Axis>(not_null<Axis*> axis) { cache.template add_prop_dependency<&Abs_Axis::Prop::position>(object.get(), axis.get()); cache.template add_prop_dependency<&Abs_Axis::Prop::pixel_length>(object.get(), axis.get()); cache.template add_prop_dependency<&Abs_Axis::Prop::orientation>(object.get(), axis.get()); if constexpr (std::derived_from<Axis, Numeric_Axis>) { cache.template add_prop_dependency<&Numeric_Axis::Prop::coordinate_range>(object.get(), axis.get()); cache.template add_prop_dependency<&Numeric_Axis::Prop::precision>(object.get(), axis.get()); cache.template add_prop_dependency<&Numeric_Axis::Prop::locale>(object.get(), axis.get()); } else if constexpr (std::derived_from<Axis, Time_Axis>) { cache.template add_prop_dependency<&Time_Axis::Prop::visible_count>(object.get(), axis.get()); cache.template add_prop_dependency<&Time_Axis::Prop::newest_at_start>(object.get(), axis.get()); cache.template add_prop_dependency<&Time_Axis::Prop::format>(object.get(), axis.get()); cache.template add_dependency<&Time_Axis::State::next_tick>(object.get(), axis.get()); } };
                 bind_axis(horizontal_axis); bind_axis(vertical_axis);
             });
         };
@@ -73,31 +79,38 @@ std::expected<std::unique_ptr<Object>, Dependency_Graph_Error> Selection_Rectang
 inline void Selection_Rectangle_Overlay::Private::paint(Selection_Rectangle_Overlay* object) {
     auto& data = double_buffer::detail::Internal_Access::get(object);
     const auto& state = static_cast<const Prop&>(double_buffer::detail::Internal_Access::current_prop(object));
-    const Size canvas = this->template read_current_prop<Render_Scene_2D::Base_Tag>(scene).viewport;
+    const Size canvas = this->template read_current_prop<
+        Render_Scene_2D::Base_Tag>(scene.value().get()).viewport;
     auto& cache = data.paint_surface();
     if (canvas.empty()) return;
     detail::Painter painter(cache, canvas);
-    const auto plot_region = map_rect(horizontal_axis, coordinate_range(horizontal_axis), vertical_axis, coordinate_range(vertical_axis));
+    const auto& horizontal = horizontal_axis.value();
+    const auto& vertical = vertical_axis.value();
+    const auto plot_region = map_rect(horizontal, coordinate_range(horizontal), vertical, coordinate_range(vertical));
     auto clip = painter.scoped_clip(plot_region);
     const auto paint_region = [&](const Axis_Rectangle& region) {
-        const auto rect = map_rect(horizontal_axis, region.horizontal, vertical_axis, region.vertical);
+        const auto rect = map_rect(horizontal, region.horizontal, vertical, region.vertical);
         painter.rect(rect, state.selection_border_pen, state.selection_brush);
         const Point_F label_position{rect.x + 4.0, rect.y + 3.0};
-        painter.text(label_position, "X " + range_label(horizontal_axis, region.horizontal), state.label_font, state.label_pen);
-        painter.text({label_position.x, label_position.y + std::max(12.0, state.label_font.size * 1.35)}, "Y " + range_label(vertical_axis, region.vertical), state.label_font, state.label_pen);
+        painter.text(label_position, "X " + range_label(horizontal, region.horizontal), state.label_font, state.label_pen);
+        painter.text({label_position.x, label_position.y + std::max(12.0, state.label_font.size * 1.35)}, "Y " + range_label(vertical, region.vertical), state.label_font, state.label_pen);
     };
     for (const auto& region : state.selected_regions) paint_region(region);
     if (dragging && has_visible_drag()) paint_region(axis_rectangle(drag_origin, drag_current));
 }
 inline bool Selection_Rectangle_Overlay::Private::has_visible_drag() const {
-    const Point_F current_position{coordinate_to_pixel(horizontal_axis, drag_current.horizontal), coordinate_to_pixel(vertical_axis, drag_current.vertical)};
+    const Point_F current_position{
+        coordinate_to_pixel(horizontal_axis.value(), drag_current.horizontal),
+        coordinate_to_pixel(vertical_axis.value(), drag_current.vertical)};
     return std::hypot(current_position.x - press_position.x, current_position.y - press_position.y) >= minimum_drag_distance_pixels;
 }
 inline void Selection_Rectangle_Overlay::Private::handle_event(Selection_Rectangle_Overlay* object, const Event& event) {
     const auto* pointer = dynamic_cast<const Pointer_Event_Capability*>(&event);
     if (!pointer) return;
     const Point_F point{pointer->position_x(), pointer->position_y()};
-    const Axis_Point axis_point{point_to_coordinate(horizontal_axis, point), point_to_coordinate(vertical_axis, point)};
+    const Axis_Point axis_point{
+        point_to_coordinate(horizontal_axis.value(), point),
+        point_to_coordinate(vertical_axis.value(), point)};
     if (event.type == Event_Type::pointer_press && pointer->pointer_button() == Mouse_Button::left) {
         const auto modifiers = static_cast<std::underlying_type_t<Keyboard_Modifier>>(pointer->keyboard_modifiers());
         const auto control = static_cast<std::underlying_type_t<Keyboard_Modifier>>(Keyboard_Modifier::control);
@@ -118,14 +131,19 @@ inline void Selection_Rectangle_Overlay::Private::handle_event(Selection_Rectang
 }
 inline Rect_F Selection_Rectangle_Overlay::Private::event_region(const Attached auto*, Size viewport) const {
     if (dragging) return {0.0, 0.0, static_cast<double>(viewport.width), static_cast<double>(viewport.height)};
-    return map_rect(horizontal_axis, coordinate_range(horizontal_axis), vertical_axis, coordinate_range(vertical_axis));
+    const auto& horizontal = horizontal_axis.value();
+    const auto& vertical = vertical_axis.value();
+    return map_rect(horizontal, coordinate_range(horizontal),
+                    vertical, coordinate_range(vertical));
 }
 template <typename Object, typename Owner, typename Member, typename Prop_Type>
 void Selection_Rectangle_Overlay::Private::after_prop_set(Object* object, Member Owner::*, Prop_Access<Prop_Type>) { if constexpr (std::same_as<Owner, Prop>) detail::Internal_Access::mark_dirty<Render_Graph_Tag>(object); }
 template <typename Object, typename Prop_Type, typename State_Type>
 void Selection_Rectangle_Overlay::Private::before_advance(Object*, Prop_Type*, State_Access<State_Type> pending_states, const Prop_Type* current_prop, State_Access<const State_Type>) { pending_states.template get<Selection_Rectangle_Overlay::Base_Tag>().selected_region_count = static_cast<const Prop&>(*current_prop).selected_regions.size(); }
 template <typename Horizontal_Axis, typename Vertical_Axis>
-void Selection_Rectangle_Overlay::Private::bind_sources(Horizontal_Axis* horizontal_axis_value, Vertical_Axis* vertical_axis_value) {
+void Selection_Rectangle_Overlay::Private::bind_sources(
+    not_null<Horizontal_Axis*> horizontal_axis_value,
+    not_null<Vertical_Axis*> vertical_axis_value) {
     horizontal_axis = horizontal_axis_value;
     vertical_axis = vertical_axis_value;
 }
diff --git a/render_2D/render_2D/plottable/Spectrum.hpp b/render_2D/render_2D/plottable/Spectrum.hpp
index fd5252d..31736ba 100644
--- a/render_2D/render_2D/plottable/Spectrum.hpp
+++ b/render_2D/render_2D/plottable/Spectrum.hpp
@@ -60,12 +60,13 @@ struct Spectrum : Def<Spectrum, Renderable_2D,
     template <typename Object>
     struct Builder : Prev_Builder<Object> {
         using Base = Prev_Builder<Object>;
-        Builder(Frequency_Object* frequency_axis, Power_Object* power_axis,
+        Builder(not_null<Frequency_Object*> frequency_axis,
+                not_null<Power_Object*> power_axis,
                 Plot_Partition_Count partition_count = 1);
         [[nodiscard]] std::expected<std::unique_ptr<Object>, Dependency_Graph_Error> build();
     private:
-        Frequency_Object* frequency_axis{}; /* 不拥有的频率轴；生命周期必须覆盖 Spectrum。 */
-        Power_Object* power_axis{}; /* 不拥有的功率轴；生命周期必须覆盖 Spectrum。 */
+        not_null<Frequency_Object*> frequency_axis; /* 不拥有的频率轴；生命周期必须覆盖 Spectrum。 */
+        not_null<Power_Object*> power_axis; /* 不拥有的功率轴；生命周期必须覆盖 Spectrum。 */
     };
 };
 }
diff --git a/render_2D/render_2D/plottable/Spectrum.ipp b/render_2D/render_2D/plottable/Spectrum.ipp
index d811667..6d1e9f3 100644
--- a/render_2D/render_2D/plottable/Spectrum.ipp
+++ b/render_2D/render_2D/plottable/Spectrum.ipp
@@ -1,4 +1,5 @@
 #pragma once
+#include <optional>
 #include <algorithm>
 #include <array>
 #include <cmath>
@@ -32,16 +33,17 @@ struct Spectrum::Private : Prev_Private {
         Size canvas_size{}; /* 所属 Scene viewport 决定的颜色层尺寸。 */
         bool valid{}; /* 两根轴与画布是否足以生成绘制数据。 */
     };
-    Scene_Object* scene{}; /* 不拥有的所属二维 Scene；Builder 已登记状态层依赖。 */
-    Frequency_Object* frequency_axis{}; /* 不拥有的频率轴；Prepare 直接读取其当前状态。 */
-    Power_Object* power_axis{}; /* 不拥有的功率轴；Prepare 直接读取其当前状态。 */
+    std::optional<not_null<Scene_Object*>> scene{}; /* 不拥有的所属二维 Scene；Builder 已登记状态层依赖。 */
+    std::optional<not_null<Frequency_Object*>> frequency_axis{}; /* 不拥有的频率轴；Prepare 直接读取其当前状态。 */
+    std::optional<not_null<Power_Object*>> power_axis{}; /* 不拥有的功率轴；Prepare 直接读取其当前状态。 */
     Prepared prepared{}; /* 当前权威 State、Frame 和轴状态推导出的 Paint 输入。 */
     std::vector<Spectrum_Power> maxima{}; /* 当前样本历史逐点最大值；只由 Prepare 更新。 */
     std::vector<Spectrum_Power> minima{}; /* 当前样本历史逐点最小值；只由 Prepare 更新。 */
     bool hold_history_reset{}; /* prepare.frame 是否已用当前帧初始化整段保持值。 */
     std::size_t graph_partition_count{};
     /* Builder 内部绑定 Scene 与两根轴；三个来源都必须比 Spectrum 生命周期更长。 */
-    void bind_render_sources(Frequency_Object* frequency_axis_value, Power_Object* power_axis_value);
+    void bind_render_sources(not_null<Frequency_Object*> frequency_axis_value,
+                             not_null<Power_Object*> power_axis_value);
     /* CRTP State 钩子：Spectrum 业务状态写入后标记自身 Prepare；其他继承层状态由各自 Private 负责。 */
     template <typename Object, typename Owner, typename Member, typename Prop_Type>
     void after_prop_set(Object* object, Member Owner::* member, Prop_Access<Prop_Type> pending_states);
@@ -58,8 +60,8 @@ struct Spectrum::Private : Prev_Private {
 };
 template <typename Object>
 Spectrum::Builder<Object>::Builder(
-    Frequency_Object* frequency_axis_value,
-    Power_Object* power_axis_value,
+    not_null<Frequency_Object*> frequency_axis_value,
+    not_null<Power_Object*> power_axis_value,
     Plot_Partition_Count partition_count)
     : Base(), frequency_axis(frequency_axis_value),
       power_axis(power_axis_value) {
@@ -72,24 +74,25 @@ std::expected<std::unique_ptr<Object>, Dependency_Graph_Error> Spectrum::Builder
     auto spectrum = std::move(result).value();
     auto& private_data = detail::Internal_Access::layer<Object>(spectrum.get());
     private_data.bind_render_sources(frequency_axis, power_axis);
-    private_data.scene_attach = [object = spectrum.get()](Root* root) -> std::expected<void, Dependency_Graph_Error> {
-        auto* scene = static_cast<Scene_Object*>(root);
-        auto& data = detail::Internal_Access::layer<Object>(object);
+    private_data.scene_attach = [object = not_null{spectrum.get()}](
+        not_null<Root*> root) -> std::expected<void, Dependency_Graph_Error> {
+        const not_null scene{static_cast<Scene_Object*>(root.get())};
+        auto& data = detail::Internal_Access::layer<Object>(object.get());
         data.scene = scene;
-        auto* frequency_axis = data.frequency_axis;
-        auto* power_axis = data.power_axis;
-        return detail::Internal_Access::edit_dependency_graph<Render_Graph_Tag, Render_Cache_Tag>(scene, [&](auto& graph, auto& cache) {
-            graph.add_dependency(frequency_axis, object);
-            graph.add_dependency(power_axis, object);
-            cache.template add_prop_dependency<&Render_Scene_2D::Prop::viewport>(object, scene);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::position>(object, frequency_axis);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::pixel_length>(object, frequency_axis);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::orientation>(object, frequency_axis);
-            cache.template add_prop_dependency<&Numeric_Axis::Prop::coordinate_range>(object, frequency_axis);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::position>(object, power_axis);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::pixel_length>(object, power_axis);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::orientation>(object, power_axis);
-            cache.template add_prop_dependency<&Numeric_Axis::Prop::coordinate_range>(object, power_axis);
+        const auto frequency_axis = data.frequency_axis.value();
+        const auto power_axis = data.power_axis.value();
+        return detail::Internal_Access::edit_dependency_graph<Render_Graph_Tag, Render_Cache_Tag>(scene.get(), [&](auto& graph, auto& cache) {
+            graph.add_dependency(frequency_axis.get(), object.get());
+            graph.add_dependency(power_axis.get(), object.get());
+            cache.template add_prop_dependency<&Render_Scene_2D::Prop::viewport>(object.get(), scene.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::position>(object.get(), frequency_axis.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::pixel_length>(object.get(), frequency_axis.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::orientation>(object.get(), frequency_axis.get());
+            cache.template add_prop_dependency<&Numeric_Axis::Prop::coordinate_range>(object.get(), frequency_axis.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::position>(object.get(), power_axis.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::pixel_length>(object.get(), power_axis.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::orientation>(object.get(), power_axis.get());
+            cache.template add_prop_dependency<&Numeric_Axis::Prop::coordinate_range>(object.get(), power_axis.get());
         });
     };
     return spectrum;
@@ -155,6 +158,8 @@ inline Task_Graph Spectrum::Private::build_graph(Spectrum* object, const Prop& s
 }
 inline void Spectrum::Private::prepare_frame(Spectrum* object, std::size_t partition_count) {
     auto& private_data = double_buffer::detail::Internal_Access::get(object);
+    const auto frequency = frequency_axis.value().get();
+    const auto power = power_axis.value().get();
     const auto& state = static_cast<const Prop&>(double_buffer::detail::Internal_Access::current_prop(object));
     const auto& frame = double_buffer::detail::Internal_Access::current_buffer<Spectrum_Frame_Tag>(object);
     hold_history_reset = maxima.size() != frame.samples.size();
@@ -162,21 +167,22 @@ inline void Spectrum::Private::prepare_frame(Spectrum* object, std::size_t parti
         maxima = frame.samples;
         minima = frame.samples;
     }
-    const auto& scene_state = this->template read_current_prop<Render_Scene_2D::Base_Tag>(scene);
-    const auto& frequency_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(frequency_axis);
-    const auto& power_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(power_axis);
-    const auto& power_state = this->template read_current_prop<Numeric_Axis::Base_Tag>(power_axis);
+    const auto& scene_state = this->template read_current_prop<Render_Scene_2D::Base_Tag>(
+        scene.value().get());
+    const auto& frequency_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(frequency);
+    const auto& power_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(power);
+    const auto& power_state = this->template read_current_prop<Numeric_Axis::Base_Tag>(power);
     prepared = {};
     prepared.partitions.resize(partition_count);
     if (frequency_layout.orientation == power_layout.orientation) return;
     if (scene_state.viewport.empty()) return;
     prepared.canvas_size = scene_state.viewport;
-    if (state.sweep_region_visible) prepared.sweep_region = detail::map_plot_rect(frequency_axis, state.sweep_frequency_range, power_axis, power_state.coordinate_range, frequency_layout.orientation);
-    prepared.markers.push_back({detail::map_plot_point(frequency_axis, state.center_frequency, power_axis, power_state.coordinate_range.origin, frequency_layout.orientation), detail::map_plot_point(frequency_axis, state.center_frequency, power_axis, power_state.coordinate_range.target, frequency_layout.orientation), Marker_Style::middle});
+    if (state.sweep_region_visible) prepared.sweep_region = detail::map_plot_rect(frequency, state.sweep_frequency_range, power, power_state.coordinate_range, frequency_layout.orientation);
+    prepared.markers.push_back({detail::map_plot_point(frequency, state.center_frequency, power, power_state.coordinate_range.origin, frequency_layout.orientation), detail::map_plot_point(frequency, state.center_frequency, power, power_state.coordinate_range.target, frequency_layout.orientation), Marker_Style::middle});
     for (std::size_t index = 0; index < state.custom_markers.size(); ++index) {
         const Spectrum_Frequency frequency = state.custom_markers[index];
         const Marker_Style style = static_cast<Spectrum_Marker_Index>(index) == state.selected_marker ? Marker_Style::selected : Marker_Style::normal;
-        prepared.markers.push_back({detail::map_plot_point(frequency_axis, frequency, power_axis, power_state.coordinate_range.origin, frequency_layout.orientation), detail::map_plot_point(frequency_axis, frequency, power_axis, power_state.coordinate_range.target, frequency_layout.orientation), style});
+        prepared.markers.push_back({detail::map_plot_point(frequency_axis.value().get(), frequency, power, power_state.coordinate_range.origin, frequency_layout.orientation), detail::map_plot_point(frequency_axis.value().get(), frequency, power, power_state.coordinate_range.target, frequency_layout.orientation), style});
     }
     prepared.valid = true;
 }
@@ -221,9 +227,10 @@ inline void Spectrum::Private::prepare_extreme(Spectrum* object, bool maximum) {
         state.frequency_range.length() *
             static_cast<Spectrum_Interpolation_Ratio>(index) / denominator;
     const auto& frequency_layout = this->template read_current_prop<
-        Abs_Axis::Base_Tag>(frequency_axis);
+        Abs_Axis::Base_Tag>(frequency_axis.value().get());
     prepared.extremes[slot] = Prepared_Extreme{
-        detail::map_plot_point(frequency_axis, frequency, power_axis, *iterator,
+        detail::map_plot_point(frequency_axis.value().get(), frequency,
+                               power_axis.value().get(), *iterator,
                                frequency_layout.orientation),
         maximum};
 }
@@ -233,16 +240,18 @@ inline void Spectrum::Private::prepare_partition(Spectrum* object, std::size_t p
     const auto& state = static_cast<const Prop&>(double_buffer::detail::Internal_Access::current_prop(object));
     const auto& frame = double_buffer::detail::Internal_Access::current_buffer<Spectrum_Frame_Tag>(object);
     if (frame.samples.empty()) return;
-    const auto& frequency_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(frequency_axis);
-    const auto& power_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(power_axis);
-    const auto& frequency_state = this->template read_current_prop<Numeric_Axis::Base_Tag>(frequency_axis);
-    const auto& power_state = this->template read_current_prop<Numeric_Axis::Base_Tag>(power_axis);
+    const auto frequency = frequency_axis.value().get();
+    const auto power = power_axis.value().get();
+    const auto& frequency_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(frequency);
+    const auto& power_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(power);
+    const auto& frequency_state = this->template read_current_prop<Numeric_Axis::Base_Tag>(frequency);
+    const auto& power_state = this->template read_current_prop<Numeric_Axis::Base_Tag>(power);
     const auto range = detail::curve_partition_range(frame.samples.size(), partition_index, prepared.partitions.size(), state.frequency_range);
     auto& partition = prepared.partitions[partition_index];
-    partition.clip = detail::map_plot_rect(frequency_axis, range.domain, power_axis, power_state.coordinate_range, frequency_layout.orientation);
-    partition.current = detail::prepare_curve(std::span<const Spectrum_Power>(frame.samples).subspan(range.first_sample, range.sample_count), range.domain, state.interpolation_mode, state.visible_range_only, frequency_state.coordinate_range, power_state.coordinate_range, frequency_axis, power_axis, frequency_layout.orientation, power_layout.orientation);
-    if (state.max_hold_visible && maxima.size() == frame.samples.size()) partition.maximum = detail::prepare_curve(std::span<const Spectrum_Power>(maxima).subspan(range.first_sample, range.sample_count), range.domain, state.interpolation_mode, state.visible_range_only, frequency_state.coordinate_range, power_state.coordinate_range, frequency_axis, power_axis, frequency_layout.orientation, power_layout.orientation);
-    if (state.min_hold_visible && minima.size() == frame.samples.size()) partition.minimum = detail::prepare_curve(std::span<const Spectrum_Power>(minima).subspan(range.first_sample, range.sample_count), range.domain, state.interpolation_mode, state.visible_range_only, frequency_state.coordinate_range, power_state.coordinate_range, frequency_axis, power_axis, frequency_layout.orientation, power_layout.orientation);
+    partition.clip = detail::map_plot_rect(frequency, range.domain, power, power_state.coordinate_range, frequency_layout.orientation);
+    partition.current = detail::prepare_curve(std::span<const Spectrum_Power>(frame.samples).subspan(range.first_sample, range.sample_count), range.domain, state.interpolation_mode, state.visible_range_only, frequency_state.coordinate_range, power_state.coordinate_range, frequency, power, frequency_layout.orientation, power_layout.orientation);
+    if (state.max_hold_visible && maxima.size() == frame.samples.size()) partition.maximum = detail::prepare_curve(std::span<const Spectrum_Power>(maxima).subspan(range.first_sample, range.sample_count), range.domain, state.interpolation_mode, state.visible_range_only, frequency_state.coordinate_range, power_state.coordinate_range, frequency, power, frequency_layout.orientation, power_layout.orientation);
+    if (state.min_hold_visible && minima.size() == frame.samples.size()) partition.minimum = detail::prepare_curve(std::span<const Spectrum_Power>(minima).subspan(range.first_sample, range.sample_count), range.domain, state.interpolation_mode, state.visible_range_only, frequency_state.coordinate_range, power_state.coordinate_range, frequency, power, frequency_layout.orientation, power_layout.orientation);
 }
 inline void Spectrum::Private::begin_paint(Spectrum* object) {
     auto& private_data = double_buffer::detail::Internal_Access::get(object);
@@ -303,7 +312,9 @@ void Spectrum::Private::after_prop_set(Object* object, Member Owner::*,
         detail::Internal_Access::mark_dirty<Render_Graph_Tag>(object);
     }
 }
-inline void Spectrum::Private::bind_render_sources(Frequency_Object* frequency_axis_value, Power_Object* power_axis_value) {
+inline void Spectrum::Private::bind_render_sources(
+    not_null<Frequency_Object*> frequency_axis_value,
+    not_null<Power_Object*> power_axis_value) {
     frequency_axis = frequency_axis_value;
     power_axis = power_axis_value;
 }
diff --git a/render_2D/render_2D/plottable/Sweep_Spectrum.hpp b/render_2D/render_2D/plottable/Sweep_Spectrum.hpp
index 7d189dc..6db76fe 100644
--- a/render_2D/render_2D/plottable/Sweep_Spectrum.hpp
+++ b/render_2D/render_2D/plottable/Sweep_Spectrum.hpp
@@ -42,12 +42,13 @@ struct Sweep_Spectrum : Def<Sweep_Spectrum, Renderable_2D,
     template <typename Object>
     struct Builder : Prev_Builder<Object> {
         using Base = Prev_Builder<Object>;
-        Builder(Frequency_Object* frequency_axis, Power_Object* power_axis,
+        Builder(not_null<Frequency_Object*> frequency_axis,
+                not_null<Power_Object*> power_axis,
                 Plot_Partition_Count partition_count = 1);
         [[nodiscard]] std::expected<std::unique_ptr<Object>, Dependency_Graph_Error> build();
     private:
-        Frequency_Object* frequency_axis{};                  /* 不拥有的频率轴。 */
-        Power_Object* power_axis{};                          /* 不拥有的功率轴。 */
+        not_null<Frequency_Object*> frequency_axis;          /* 不拥有的频率轴。 */
+        not_null<Power_Object*> power_axis;                  /* 不拥有的功率轴。 */
     };
 };
 }
diff --git a/render_2D/render_2D/plottable/Sweep_Spectrum.ipp b/render_2D/render_2D/plottable/Sweep_Spectrum.ipp
index 050ef25..7c636ca 100644
--- a/render_2D/render_2D/plottable/Sweep_Spectrum.ipp
+++ b/render_2D/render_2D/plottable/Sweep_Spectrum.ipp
@@ -1,4 +1,5 @@
 #pragma once
+#include <optional>
 #include "common/Curve_Plot.hpp"
 #include <algorithm>
 #include <iterator>
@@ -13,9 +14,9 @@ struct Sweep_Spectrum::Private : Prev_Private {
         Size canvas{};                                       /* 当前 Scene viewport 的像素尺寸。 */
         bool valid{};                                        /* 两根轴正交、画布及组合折线均有效。 */
     };
-    Scene_Object* scene{};                                   /* 不拥有的所属 Scene。 */
-    Frequency_Object* frequency_axis{};                      /* 不拥有的频率轴。 */
-    Power_Object* power_axis{};                              /* 不拥有的功率轴。 */
+    std::optional<not_null<Scene_Object*>> scene{};           /* 不拥有的所属 Scene。 */
+    std::optional<not_null<Frequency_Object*>> frequency_axis{}; /* 不拥有的频率轴。 */
+    std::optional<not_null<Power_Object*>> power_axis{};      /* 不拥有的功率轴。 */
     /*
      * 完整扫频的唯一持久状态。每次交换得到一组块更新并原位覆盖相应槽位；
      * 三缓冲只负责跨线程交付输入组，不承担扫频历史保存职责。
@@ -25,7 +26,8 @@ struct Sweep_Spectrum::Private : Prev_Private {
     bool has_latest_block{};
     Prepared prepared{};                                     /* 当前块集合推导出的绘制输入。 */
     Plot_Partition_Count graph_partition_count{};            /* 当前 Prepare 子图分块数。 */
-    void bind_sources(Frequency_Object* frequency_axis_value, Power_Object* power_axis_value);
+    void bind_sources(not_null<Frequency_Object*> frequency_axis_value,
+                      not_null<Power_Object*> power_axis_value);
     /* CRTP 覆盖：按扫描点规模构建分块 Prepare 子图。 */
     [[nodiscard]] Task_Graph build_graph(Sweep_Spectrum* object, const Prop& state);
     [[nodiscard]] bool should_rebuild_graph(Sweep_Spectrum* object, const Prop& state);
@@ -38,8 +40,8 @@ struct Sweep_Spectrum::Private : Prev_Private {
 };
 template <typename Object>
 Sweep_Spectrum::Builder<Object>::Builder(
-    Frequency_Object* frequency_axis_value,
-    Power_Object* power_axis_value,
+    not_null<Frequency_Object*> frequency_axis_value,
+    not_null<Power_Object*> power_axis_value,
     Plot_Partition_Count partition_count)
     : Base(), frequency_axis(frequency_axis_value),
       power_axis(power_axis_value) {
@@ -47,8 +49,45 @@ Sweep_Spectrum::Builder<Object>::Builder(
 }
 template <typename Object>
 std::expected<std::unique_ptr<Object>, Dependency_Graph_Error> Sweep_Spectrum::Builder<Object>::build() {
-    auto result = Base::build(); if (!result) return std::unexpected(result.error()); auto sweep = std::move(result).value(); auto& private_data = detail::Internal_Access::get(sweep.get()); private_data.bind_sources(frequency_axis, power_axis);
-    private_data.scene_attach = [object = sweep.get()](Root* root) -> std::expected<void, Dependency_Graph_Error> { auto* scene = static_cast<Scene_Object*>(root); auto& data = detail::Internal_Access::get(object); data.scene = scene; auto* frequency_axis = data.frequency_axis; auto* power_axis = data.power_axis; return detail::Internal_Access::edit_dependency_graph<Render_Graph_Tag, Render_Cache_Tag>(scene, [&](auto& graph, auto& cache) { graph.add_dependency(frequency_axis, object); graph.add_dependency(power_axis, object); cache.template add_prop_dependency<&Render_Scene_2D::Prop::viewport>(object, scene); cache.template add_prop_dependency<&Abs_Axis::Prop::position>(object, frequency_axis); cache.template add_prop_dependency<&Abs_Axis::Prop::pixel_length>(object, frequency_axis); cache.template add_prop_dependency<&Abs_Axis::Prop::orientation>(object, frequency_axis); cache.template add_prop_dependency<&Numeric_Axis::Prop::coordinate_range>(object, frequency_axis); cache.template add_prop_dependency<&Abs_Axis::Prop::position>(object, power_axis); cache.template add_prop_dependency<&Abs_Axis::Prop::pixel_length>(object, power_axis); cache.template add_prop_dependency<&Abs_Axis::Prop::orientation>(object, power_axis); cache.template add_prop_dependency<&Numeric_Axis::Prop::coordinate_range>(object, power_axis); }); }; return sweep;
+    auto result = Base::build();
+    if (!result) return std::unexpected(result.error());
+    auto sweep = std::move(result).value();
+    const not_null object{sweep.get()};
+    auto& private_data = detail::Internal_Access::get(object.get());
+    private_data.bind_sources(frequency_axis, power_axis);
+    private_data.scene_attach = [object](not_null<Root*> root)
+        -> std::expected<void, Dependency_Graph_Error> {
+        const not_null scene{static_cast<Scene_Object*>(root.get())};
+        auto& data = detail::Internal_Access::get(object.get());
+        data.scene = scene;
+        const auto frequency = data.frequency_axis.value();
+        const auto power = data.power_axis.value();
+        return detail::Internal_Access::edit_dependency_graph<
+            Render_Graph_Tag, Render_Cache_Tag>(
+            scene.get(), [&](auto& graph, auto& cache) {
+                graph.add_dependency(frequency.get(), object.get());
+                graph.add_dependency(power.get(), object.get());
+                cache.template add_prop_dependency<
+                    &Render_Scene_2D::Prop::viewport>(object.get(), scene.get());
+                cache.template add_prop_dependency<
+                    &Abs_Axis::Prop::position>(object.get(), frequency.get());
+                cache.template add_prop_dependency<
+                    &Abs_Axis::Prop::pixel_length>(object.get(), frequency.get());
+                cache.template add_prop_dependency<
+                    &Abs_Axis::Prop::orientation>(object.get(), frequency.get());
+                cache.template add_prop_dependency<
+                    &Numeric_Axis::Prop::coordinate_range>(object.get(), frequency.get());
+                cache.template add_prop_dependency<
+                    &Abs_Axis::Prop::position>(object.get(), power.get());
+                cache.template add_prop_dependency<
+                    &Abs_Axis::Prop::pixel_length>(object.get(), power.get());
+                cache.template add_prop_dependency<
+                    &Abs_Axis::Prop::orientation>(object.get(), power.get());
+                cache.template add_prop_dependency<
+                    &Numeric_Axis::Prop::coordinate_range>(object.get(), power.get());
+            });
+    };
+    return sweep;
 }
 inline bool Sweep_Spectrum::Private::should_rebuild_graph(Sweep_Spectrum*, const Prop& state) { return graph_partition_count != state.partition_count; }
 inline Task_Graph Sweep_Spectrum::Private::build_graph(Sweep_Spectrum* object, const Prop& state) {
@@ -72,7 +111,19 @@ inline Task_Graph Sweep_Spectrum::Private::build_graph(Sweep_Spectrum* object, c
     return graph;
 }
 inline void Sweep_Spectrum::Private::prepare_frame(Sweep_Spectrum* object) {
-    const auto& state = this->template read_current_prop<Sweep_Spectrum::Base_Tag>(object); const auto& frequency_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(frequency_axis); const auto& power_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(power_axis); const auto& power_state = this->template read_current_prop<Numeric_Axis::Base_Tag>(power_axis); prepared = {}; prepared.canvas = this->template read_current_prop<Render_Scene_2D::Base_Tag>(scene).viewport;
+    const auto frequency = frequency_axis.value().get();
+    const auto power = power_axis.value().get();
+    const auto& state = this->template read_current_prop<
+        Sweep_Spectrum::Base_Tag>(object);
+    const auto& frequency_layout = this->template read_current_prop<
+        Abs_Axis::Base_Tag>(frequency);
+    const auto& power_layout = this->template read_current_prop<
+        Abs_Axis::Base_Tag>(power);
+    const auto& power_state = this->template read_current_prop<
+        Numeric_Axis::Base_Tag>(power);
+    prepared = {};
+    prepared.canvas = this->template read_current_prop<
+        Render_Scene_2D::Base_Tag>(scene.value().get()).viewport;
     const std::size_t block_count = std::max<std::size_t>(1, state.block_count);
     if (sweep_blocks.size() != block_count) {
         sweep_blocks.assign(block_count, {});
@@ -105,11 +156,38 @@ inline void Sweep_Spectrum::Private::prepare_frame(Sweep_Spectrum* object) {
     const auto domain_target = state.frequency_range.origin + state.frequency_range.length() * domain_progress;
     const auto latest_frequency = state.frequency_range.origin + state.frequency_range.length() * marker_progress;
     prepared.domain = {state.frequency_range.origin, domain_target};
-    prepared.marker_first = detail::map_plot_point(frequency_axis, latest_frequency, power_axis, power_state.coordinate_range.origin, frequency_layout.orientation); prepared.marker_second = detail::map_plot_point(frequency_axis, latest_frequency, power_axis, power_state.coordinate_range.target, frequency_layout.orientation); prepared.valid = true;
+    prepared.marker_first = detail::map_plot_point(
+        frequency, latest_frequency, power, power_state.coordinate_range.origin,
+        frequency_layout.orientation);
+    prepared.marker_second = detail::map_plot_point(
+        frequency, latest_frequency, power, power_state.coordinate_range.target,
+        frequency_layout.orientation);
+    prepared.valid = true;
 }
 inline void Sweep_Spectrum::Private::prepare_partition(Sweep_Spectrum* object, Plot_Partition_Count index) {
-    if (!prepared.valid) return; const auto& state = this->template read_current_prop<Sweep_Spectrum::Base_Tag>(object); const auto& frequency_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(frequency_axis); const auto& power_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(power_axis); const auto& frequency_state = this->template read_current_prop<Numeric_Axis::Base_Tag>(frequency_axis); const auto& power_state = this->template read_current_prop<Numeric_Axis::Base_Tag>(power_axis); const auto range = detail::curve_partition_range(prepared.values.size(), index, prepared.partitions.size(), prepared.domain);
-    prepared.partitions[index] = detail::prepare_curve(std::span<const Plot_Value>(prepared.values).subspan(range.first_sample, range.sample_count), range.domain, state.interpolation_mode, state.visible_range_only, frequency_state.coordinate_range, power_state.coordinate_range, frequency_axis, power_axis, frequency_layout.orientation, power_layout.orientation);
+    if (!prepared.valid) return;
+    const auto frequency = frequency_axis.value().get();
+    const auto power = power_axis.value().get();
+    const auto& state = this->template read_current_prop<
+        Sweep_Spectrum::Base_Tag>(object);
+    const auto& frequency_layout = this->template read_current_prop<
+        Abs_Axis::Base_Tag>(frequency);
+    const auto& power_layout = this->template read_current_prop<
+        Abs_Axis::Base_Tag>(power);
+    const auto& frequency_state = this->template read_current_prop<
+        Numeric_Axis::Base_Tag>(frequency);
+    const auto& power_state = this->template read_current_prop<
+        Numeric_Axis::Base_Tag>(power);
+    const auto range = detail::curve_partition_range(
+        prepared.values.size(), index, prepared.partitions.size(),
+        prepared.domain);
+    prepared.partitions[index] = detail::prepare_curve(
+        std::span<const Plot_Value>(prepared.values).subspan(
+            range.first_sample, range.sample_count),
+        range.domain, state.interpolation_mode, state.visible_range_only,
+        frequency_state.coordinate_range, power_state.coordinate_range,
+        frequency, power, frequency_layout.orientation,
+        power_layout.orientation);
 }
 inline void Sweep_Spectrum::Private::paint_partition(Sweep_Spectrum* object, Plot_Partition_Count index) {
     if (!prepared.valid || index >= prepared.partitions.size()) return;
@@ -140,7 +218,12 @@ void Sweep_Spectrum::Private::after_prop_set(
         detail::Internal_Access::mark_dirty<Render_Graph_Tag>(object);
     }
 }
-inline void Sweep_Spectrum::Private::bind_sources(Frequency_Object* frequency_axis_value, Power_Object* power_axis_value) { frequency_axis = frequency_axis_value; power_axis = power_axis_value; }
+inline void Sweep_Spectrum::Private::bind_sources(
+    not_null<Frequency_Object*> frequency_axis_value,
+    not_null<Power_Object*> power_axis_value) {
+    frequency_axis = frequency_axis_value;
+    power_axis = power_axis_value;
+}
 inline std::size_t Sweep_Spectrum::Private::stored_point_count() const {
     std::size_t count{};
     for (const auto& block : sweep_blocks)
diff --git a/render_2D/render_2D/plottable/Waterfall.hpp b/render_2D/render_2D/plottable/Waterfall.hpp
index b5df90b..e1aacc5 100644
--- a/render_2D/render_2D/plottable/Waterfall.hpp
+++ b/render_2D/render_2D/plottable/Waterfall.hpp
@@ -42,12 +42,13 @@ struct Waterfall : Def<Waterfall, Renderable_2D,
     template <typename Object>
     struct Builder : Prev_Builder<Object> {
         using Base = Prev_Builder<Object>;
-        Builder(Frequency_Object* frequency_axis, Time_Object* time_axis,
+        Builder(not_null<Frequency_Object*> frequency_axis,
+                not_null<Time_Object*> time_axis,
                 Plot_Partition_Grid partition_grid = {});
         [[nodiscard]] std::expected<std::unique_ptr<Object>, Dependency_Graph_Error> build();
     private:
-        Frequency_Object* frequency_axis{}; /* 不拥有的频率轴；生命周期必须覆盖 Waterfall。 */
-        Time_Object* time_axis{};           /* 不拥有的时间轴；生命周期必须覆盖 Waterfall。 */
+        not_null<Frequency_Object*> frequency_axis; /* 不拥有的频率轴；生命周期必须覆盖 Waterfall。 */
+        not_null<Time_Object*> time_axis;           /* 不拥有的时间轴；生命周期必须覆盖 Waterfall。 */
     };
 };
 }
diff --git a/render_2D/render_2D/plottable/Waterfall.ipp b/render_2D/render_2D/plottable/Waterfall.ipp
index abdfb07..063ad5c 100644
--- a/render_2D/render_2D/plottable/Waterfall.ipp
+++ b/render_2D/render_2D/plottable/Waterfall.ipp
@@ -1,4 +1,5 @@
 #pragma once
+#include <optional>
 #include "common/Curve_Plot.hpp"
 #include "common/Raster_Plot.hpp"
 #include <algorithm>
@@ -23,13 +24,14 @@ struct Waterfall::Private : Prev_Private {
         int source_first{}; /* 可视频段在源频谱行中的首列。 */
         bool valid{}; /* 轴布局和行数据是否足以生成色块。 */
     };
-    Scene_Object* scene{}; /* 不拥有的所属 Scene。 */
-    Frequency_Object* frequency_axis{}; /* 不拥有的频率轴。 */
-    Time_Object* time_axis{}; /* 不拥有的时间轴，同时权威决定保留行数。 */
+    std::optional<not_null<Scene_Object*>> scene{}; /* 不拥有的所属 Scene。 */
+    std::optional<not_null<Frequency_Object*>> frequency_axis{}; /* 不拥有的频率轴。 */
+    std::optional<not_null<Time_Object*>> time_axis{}; /* 不拥有的时间轴，同时权威决定保留行数。 */
     Prepared prepared{}; /* 当前权威状态推导出的 Paint 输入。 */
     detail::Hover_Tooltip_Runtime tooltip{}; /* 事件侧当前 hover 位置。 */
     Plot_Partition_Grid graph_partition_grid{}; /* Prepare/Paint 子图当前固化的 framebuffer 列×行网格。 */
-    void bind_sources(Frequency_Object* frequency_axis_value, Time_Object* time_axis_value);
+    void bind_sources(not_null<Frequency_Object*> frequency_axis_value,
+                      not_null<Time_Object*> time_axis_value);
     /* CRTP 覆盖：按当前色块工作量构建分块 Prepare 子图。 */
     [[nodiscard]] Task_Graph build_graph(Waterfall* object, const Prop& state);
     [[nodiscard]] bool should_rebuild_graph(Waterfall* object, const Prop& state);
@@ -45,7 +47,8 @@ struct Waterfall::Private : Prev_Private {
 };
 template <typename Object>
 Waterfall::Builder<Object>::Builder(
-    Frequency_Object* frequency_axis_value, Time_Object* time_axis_value,
+    not_null<Frequency_Object*> frequency_axis_value,
+    not_null<Time_Object*> time_axis_value,
     Plot_Partition_Grid partition_grid)
     : Base(), frequency_axis(frequency_axis_value),
       time_axis(time_axis_value) {
@@ -58,26 +61,27 @@ std::expected<std::unique_ptr<Object>, Dependency_Graph_Error> Waterfall::Builde
     auto plot = std::move(result).value();
     auto& private_data = detail::Internal_Access::layer<Object>(plot.get());
     private_data.bind_sources(frequency_axis, time_axis);
-    private_data.scene_attach = [object = plot.get()](Root* root) -> std::expected<void, Dependency_Graph_Error> {
-        auto* scene = static_cast<Scene_Object*>(root);
-        auto& data = detail::Internal_Access::layer<Object>(object);
+    private_data.scene_attach = [object = not_null{plot.get()}](
+        not_null<Root*> root) -> std::expected<void, Dependency_Graph_Error> {
+        const not_null scene{static_cast<Scene_Object*>(root.get())};
+        auto& data = detail::Internal_Access::layer<Object>(object.get());
         data.scene = scene;
-        auto* frequency_axis = data.frequency_axis;
-        auto* time_axis = data.time_axis;
-        return detail::Internal_Access::edit_dependency_graph<Render_Graph_Tag, Render_Cache_Tag>(scene, [&](auto& graph, auto& cache) {
-            graph.add_dependency(frequency_axis, object);
-            graph.add_dependency(time_axis, object);
-            cache.template add_prop_dependency<&Render_Scene_2D::Prop::viewport>(object, scene);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::position>(object, frequency_axis);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::pixel_length>(object, frequency_axis);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::orientation>(object, frequency_axis);
-            cache.template add_prop_dependency<&Numeric_Axis::Prop::coordinate_range>(object, frequency_axis);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::position>(object, time_axis);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::pixel_length>(object, time_axis);
-            cache.template add_prop_dependency<&Abs_Axis::Prop::orientation>(object, time_axis);
-            cache.template add_prop_dependency<&Time_Axis::Prop::visible_count>(object, time_axis);
-            cache.template add_prop_dependency<&Time_Axis::Prop::newest_at_start>(object, time_axis);
-            cache.template add_dependency<&Time_Axis::State::next_tick>(object, time_axis);
+        const auto frequency_axis = data.frequency_axis.value();
+        const auto time_axis = data.time_axis.value();
+        return detail::Internal_Access::edit_dependency_graph<Render_Graph_Tag, Render_Cache_Tag>(scene.get(), [&](auto& graph, auto& cache) {
+            graph.add_dependency(frequency_axis.get(), object.get());
+            graph.add_dependency(time_axis.get(), object.get());
+            cache.template add_prop_dependency<&Render_Scene_2D::Prop::viewport>(object.get(), scene.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::position>(object.get(), frequency_axis.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::pixel_length>(object.get(), frequency_axis.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::orientation>(object.get(), frequency_axis.get());
+            cache.template add_prop_dependency<&Numeric_Axis::Prop::coordinate_range>(object.get(), frequency_axis.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::position>(object.get(), time_axis.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::pixel_length>(object.get(), time_axis.get());
+            cache.template add_prop_dependency<&Abs_Axis::Prop::orientation>(object.get(), time_axis.get());
+            cache.template add_prop_dependency<&Time_Axis::Prop::visible_count>(object.get(), time_axis.get());
+            cache.template add_prop_dependency<&Time_Axis::Prop::newest_at_start>(object.get(), time_axis.get());
+            cache.template add_dependency<&Time_Axis::State::next_tick>(object.get(), time_axis.get());
         });
     };
     return plot;
@@ -115,7 +119,8 @@ inline void Waterfall::Private::prepare_frame(Waterfall* object) {
     const auto& state = this->template read_current_prop<Waterfall::Base_Tag>(object);
     detail::Internal_Access::exchange_stream<Waterfall_Stream_Tag>(object);
     const auto row_limit = static_cast<std::size_t>(std::max<Axis_Visible_Count>(
-        2, this->template read_current_prop<Time_Axis::Base_Tag>(time_axis).visible_count));
+        2, this->template read_current_prop<Time_Axis::Base_Tag>(
+               time_axis.value().get()).visible_count));
     detail::Internal_Access::accumulate_stream<Waterfall_Stream_Tag>(object, row_limit);
     prepared = {};
     std::vector<std::shared_ptr<const Waterfall_Row>> source_rows;
@@ -123,9 +128,12 @@ inline void Waterfall::Private::prepare_frame(Waterfall* object) {
         [&](std::span<std::shared_ptr<const Waterfall_Row>> rows) {
             source_rows.assign(rows.begin(), rows.end());
         });
-    const auto& frequency_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(frequency_axis);
-    const auto& time_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(time_axis);
-    prepared.canvas = this->template read_current_prop<Render_Scene_2D::Base_Tag>(scene).viewport;
+    const auto& frequency_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(
+        frequency_axis.value().get());
+    const auto& time_layout = this->template read_current_prop<Abs_Axis::Base_Tag>(
+        time_axis.value().get());
+    prepared.canvas = this->template read_current_prop<Render_Scene_2D::Base_Tag>(
+        scene.value().get()).viewport;
     if (source_rows.empty()) {
         return;
     }
@@ -136,14 +144,21 @@ inline void Waterfall::Private::prepare_frame(Waterfall* object) {
     const int source_columns = static_cast<int>(state.frequency_bin_count ? std::min(state.frequency_bin_count, available) : available);
     const auto selection = detail::raster_axis_selection(
         state.frequency_range,
-        detail::Internal_Access::layer<Abs_Axis>(frequency_axis).runtime_coordinate_range(),
+        detail::Internal_Access::layer<Abs_Axis>(
+            frequency_axis.value().get()).runtime_coordinate_range(),
         source_columns, state.visible_range_only);
     if (!selection) {
         return;
     }
-    const int time_slots = std::max<Axis_Visible_Count>(2, this->template read_current_prop<Time_Axis::Base_Tag>(time_axis).visible_count);
-    const Axis_Range time_range = detail::Internal_Access::layer<Abs_Axis>(time_axis).runtime_coordinate_range();
-    prepared.layout = detail::raster_layout(frequency_axis, selection->range, selection->count(), time_axis, time_range, time_slots, frequency_layout.orientation, time_layout.orientation);
+    const int time_slots = std::max<Axis_Visible_Count>(
+        2, this->template read_current_prop<Time_Axis::Base_Tag>(
+               time_axis.value().get()).visible_count);
+    const Axis_Range time_range = detail::Internal_Access::layer<Abs_Axis>(
+        time_axis.value().get()).runtime_coordinate_range();
+    prepared.layout = detail::raster_layout(
+        frequency_axis.value().get(), selection->range, selection->count(),
+        time_axis.value().get(), time_range, time_slots,
+        frequency_layout.orientation, time_layout.orientation);
     if (prepared.canvas.empty() || !prepared.layout.valid()) {
         return;
     }
@@ -168,7 +183,8 @@ inline void Waterfall::Private::prepare_frame(Waterfall* object) {
     if (state.tooltip_enabled && tooltip.active && prepared.layout.target.contains(tooltip.position)) {
         std::ostringstream text;
         text << std::fixed << std::setprecision(2)
-             << detail::Internal_Access::layer<Abs_Axis>(frequency_axis)
+             << detail::Internal_Access::layer<Abs_Axis>(
+                    frequency_axis.value().get())
                     .runtime_point_to_coordinate(tooltip.position)
              << " Hz";
         prepared.tooltip_text = text.str();
@@ -266,7 +282,9 @@ void Waterfall::Private::after_prop_set(Object* object,
         detail::Internal_Access::mark_dirty<Render_Graph_Tag>(object);
     }
 }
-inline void Waterfall::Private::bind_sources(Frequency_Object* frequency_axis_value, Time_Object* time_axis_value) {
+inline void Waterfall::Private::bind_sources(
+    not_null<Frequency_Object*> frequency_axis_value,
+    not_null<Time_Object*> time_axis_value) {
     frequency_axis = frequency_axis_value;
     time_axis = time_axis_value;
 }
diff --git a/render_2D/render_2D/render/Blend2D_Cache.cpp b/render_2D/render_2D/render/Blend2D_Cache.cpp
index dbd0a07..d90efb3 100644
--- a/render_2D/render_2D/render/Blend2D_Cache.cpp
+++ b/render_2D/render_2D/render/Blend2D_Cache.cpp
@@ -115,7 +115,7 @@ Size Blend2D_Cache::size() const noexcept {
 }
 Image_View Blend2D_Cache::view() const {
     if (d->image_size.empty()) return {};
-    return {d->pixels.data(), d->image_size.width, d->image_size.height,
+    return {d->pixels, d->image_size.width, d->image_size.height,
             static_cast<int>(d->row_stride()), Pixel_Format::bgra8_premultiplied};
 }
 Pixel_Buffer Blend2D_Cache::output_pixels(Pixel_Format format) const {
@@ -127,14 +127,16 @@ Pixel_Buffer Blend2D_Cache::output_pixels(Pixel_Format format) const {
     if (format == Pixel_Format::bgra8_premultiplied) {
         for (int y = 0; y < source.height; ++y)
             std::memcpy(result.bytes.data() + static_cast<std::size_t>(y) * row_size,
-                        source.data + static_cast<std::ptrdiff_t>(y) * source.stride,
+                        source.data.data() +
+                            static_cast<std::ptrdiff_t>(y) * source.stride,
                         row_size);
         return result;
     }
     if (format != Pixel_Format::rgba8)
         throw std::invalid_argument("unsupported 2D output pixel format");
     if (Private::rgba_converter().convert_rect(
-            result.bytes.data(), static_cast<intptr_t>(row_size), source.data,
+            result.bytes.data(), static_cast<intptr_t>(row_size),
+            source.data.data(),
             source.stride, static_cast<std::uint32_t>(source.width),
             static_cast<std::uint32_t>(source.height)) != BL_SUCCESS)
         throw std::runtime_error("Blend2D failed to convert PRGB32 to RGBA8");
@@ -304,12 +306,13 @@ Painter::Clip_Scope::Clip_Scope(Painter& owner, Rect_F rect) {
 }
 Painter::Clip_Scope::~Clip_Scope() {
     if (!painter) return;
-    painter->d->context.restore();
+    (*painter)->d->context.restore();
     /* restore 会回滚绘制状态；同步失效本地样式缓存，避免后续错误跳过状态设置。 */
-    painter->d->fill_color.reset();
-    painter->d->stroke_pen.reset();
+    (*painter)->d->fill_color.reset();
+    (*painter)->d->stroke_pen.reset();
 }
-Painter::Clip_Scope::Clip_Scope(Clip_Scope&& other) noexcept : painter(std::exchange(other.painter, nullptr)) {}
+Painter::Clip_Scope::Clip_Scope(Clip_Scope&& other) noexcept
+    : painter(std::exchange(other.painter, {})) {}
 Painter::operator bool() const noexcept { return d->active; }
 Painter::Clip_Scope Painter::scoped_clip(Rect_F rect) { return Clip_Scope(*this, rect); }
 void Painter::clear() { if (d->active) d->context.clear_all(); }
diff --git a/render_2D/render_2D/render/Blend2D_Cache.hpp b/render_2D/render_2D/render/Blend2D_Cache.hpp
index 568cdcb..ea052ae 100644
--- a/render_2D/render_2D/render/Blend2D_Cache.hpp
+++ b/render_2D/render_2D/render/Blend2D_Cache.hpp
@@ -1,7 +1,9 @@
 #pragma once
 #include "../base/Types.hpp"
 #include <renderable.hpp>
+#include <ownership.hpp>
 #include <memory>
+#include <optional>
 #include <span>
 #include <string_view>
 namespace aethera::render_2d {
@@ -53,7 +55,7 @@ struct Painter {
         Clip_Scope(Clip_Scope&& other) noexcept;
         Clip_Scope& operator=(Clip_Scope&& other) = delete;
     private:
-        Painter* painter{};                                   /* 非空时析构恢复对应 Painter 的裁剪状态。 */
+        std::optional<not_null<Painter*>> painter{};          /* 非空时析构恢复对应 Painter 的裁剪状态。 */
     };
     Painter(Blend2D_Cache& cache, Size size);
     /*
diff --git a/render_2D/render_2D/scene/Render_Scene_2D.cpp b/render_2D/render_2D/scene/Render_Scene_2D.cpp
index 5894360..a5cbb8b 100644
--- a/render_2D/render_2D/scene/Render_Scene_2D.cpp
+++ b/render_2D/render_2D/scene/Render_Scene_2D.cpp
@@ -3,11 +3,10 @@ namespace aethera::render_2d {
 Render_Scene_2D::Private::~Private() = default;
 bool Render_Scene_2D::Prop::operator==(const Prop&) const = default;
 
-Render_Scene_2D::Render_Result_Type Render_Scene_2D::render(Frame_2D* frame) {
-    return double_buffer::detail::Internal_Access::get(this).render(this, frame);
-}
-void Render_Scene_2D::set_frame_callback(Frame_Callback callback) {
-    double_buffer::detail::Internal_Access::get(this).set_frame_callback(this, std::move(callback));
+Render_Scene_2D::Render_Result_Type Render_Scene_2D::render(
+    not_null<Frame_2D*> frame, Frame_Callback callback) {
+    return double_buffer::detail::Internal_Access::get(this).render(
+        this, frame, std::move(callback));
 }
 void Render_Scene_2D::activate_view() {
     double_buffer::detail::Internal_Access::get(this).set_view_active(this, true);
diff --git a/render_2D/render_2D/scene/Render_Scene_2D.hpp b/render_2D/render_2D/scene/Render_Scene_2D.hpp
index 2a96196..7adcb07 100644
--- a/render_2D/render_2D/scene/Render_Scene_2D.hpp
+++ b/render_2D/render_2D/scene/Render_Scene_2D.hpp
@@ -3,6 +3,7 @@
 #include "../base/Renderable_2D.hpp"
 #include "../render/Blend2D_Cache.hpp"
 #include <scene.hpp>
+#include <ownership.hpp>
 #include <expected>
 #include <functional>
 #include <memory>
@@ -25,17 +26,18 @@ struct Render_Scene_2D : Def<Render_Scene_2D, Scene,
         using Final_Builder = typename Object::template Builder<Object>;
         Builder();
         template <Attached Renderable_Object> requires std::derived_from<Renderable_Object, Renderable_2D_Base>
-        Final_Builder& add_renderable(Renderable_Object* renderable);
+        Final_Builder& add_renderable(not_null<Renderable_Object*> renderable);
         [[nodiscard]] std::expected<std::unique_ptr<Object>, Dependency_Graph_Error> build();
     private:
-        std::vector<std::function<std::expected<void, Dependency_Graph_Error>(Object*)>> attachments{}; /* 仅在 build 期间绑定已构造 Renderable。 */
+        std::vector<std::function<std::expected<void, Dependency_Graph_Error>(
+            not_null<Object*>)>> attachments{}; /* 仅在 build 期间绑定已构造 Renderable。 */
     };
     enum struct Render_Result { frame_in_flight, view_inactive, empty_viewport };
-    using Frame_Callback = std::function<void(Frame_2D*)>;
+    using Frame_Callback = std::function<void(not_null<Frame_2D*>)>;
     using Render_Result_Type = std::expected<void, Render_Result>;
     using Render_Frame_Type = Frame_2D;
-    [[nodiscard]] Render_Result_Type render(Frame_2D* frame);
-    void set_frame_callback(Frame_Callback callback);
+    [[nodiscard]] Render_Result_Type render(
+        not_null<Frame_2D*> frame, Frame_Callback callback);
     /*
      * 向调用方拥有的 Frame 合成一次。Scene 只借用传入地址；全部绘制、
      * completion Taskflow 和 Trace 收口并清除借用后，唯一回调通知调用方。
diff --git a/render_2D/render_2D/scene/Render_Scene_2D.ipp b/render_2D/render_2D/scene/Render_Scene_2D.ipp
index 0c64192..3c1c897 100644
--- a/render_2D/render_2D/scene/Render_Scene_2D.ipp
+++ b/render_2D/render_2D/scene/Render_Scene_2D.ipp
@@ -1,6 +1,7 @@
 #pragma once
 #include "../event/Event_Routing_Rules.hpp"
 #include <atomic>
+#include <optional>
 #include <stdexcept>
 #include <unordered_map>
 #include <unordered_set>
@@ -11,10 +12,12 @@ Render_Scene_2D::Builder<Object>::Builder() : Base() {}
 template <typename Object>
 template <Attached Renderable_Object>
     requires std::derived_from<Renderable_Object, Renderable_2D_Base>
-typename Render_Scene_2D::Builder<Object>::Final_Builder& Render_Scene_2D::Builder<Object>::add_renderable(Renderable_Object* renderable) {
-    this->template add_dependency_node<Render_Graph_Tag>(renderable);
-    attachments.emplace_back([renderable](Object* scene) {
-        auto& data = Base::private_access(renderable).template get<Renderable_2D_Base::Base_Tag>();
+typename Render_Scene_2D::Builder<Object>::Final_Builder& Render_Scene_2D::Builder<Object>::add_renderable(
+    not_null<Renderable_Object*> renderable) {
+    this->template add_dependency_node<Render_Graph_Tag>(renderable.get());
+    attachments.emplace_back([renderable](not_null<Object*> scene) {
+        auto& data = Base::private_access(renderable.get())
+                         .template get<Renderable_2D_Base::Base_Tag>();
         if (!data.scene_attach)
             throw std::logic_error("2D renderable has no scene attachment contract");
         auto attach = std::move(data.scene_attach);
@@ -46,26 +49,25 @@ std::expected<std::unique_ptr<Object>, Dependency_Graph_Error> Render_Scene_2D::
 }
 struct Render_Scene_2D::Private : Prev_Private {
     struct Paint_Node {
-        Root* object{};                                      /* Paint 拓扑位置对应的最终对象；Scene 不拥有。 */
-        Renderable_2D_Base::Private* private_data{};         /* 对象的二维能力层；对象存活期间有效。 */
-        Root* cache_owner{};                                 /* 所属缓存根；空值表示直接绘制最终帧。 */
+        not_null<Root*> object;                              /* Paint 拓扑位置对应的最终对象；Scene 不拥有。 */
+        not_null<Renderable_2D_Base::Private*> private_data; /* 对象的二维能力层；对象存活期间有效。 */
+        std::optional<not_null<Root*>> cache_owner{};        /* 所属缓存根；空值表示直接绘制最终帧。 */
         bool paint_requested{};                              /* Scene 按本轮组级失效结果计算的执行许可。 */
     };
     struct Cache_Group {
-        Root* owner{};                                       /* 显式选择缓存的二维 Renderable 根。 */
-        std::vector<Root*> members{};                        /* 本缓存覆盖的根及无冲突后继节点。 */
+        not_null<Root*> owner;                               /* 显式选择缓存的二维 Renderable 根。 */
+        std::vector<not_null<Root*>> members{};              /* 本缓存覆盖的根及无冲突后继节点。 */
         bool rebuild{};                                      /* 本轮是否因任一成员失效而整体重绘。 */
     };
     struct Event_Target {
-        Renderable_2D_Base* object{};                         /* 当前 Paint 图中的事件候选对象；Scene 不拥有。 */
-        Renderable_2D_Base::Private* private_data{};          /* 候选对象的二维能力层；仅在本次 Prepare 分发期间有效。 */
+        not_null<Renderable_2D_Base*> object;                 /* 当前 Paint 图中的事件候选对象；Scene 不拥有。 */
+        not_null<Renderable_2D_Base::Private*> private_data;  /* 候选对象的二维能力层；仅在本次 Prepare 分发期间有效。 */
     };
     std::atomic_bool frame_in_flight{};                       /* Scene 当前是否仍借用一个外部 Frame。 */
-    std::atomic<std::shared_ptr<const Frame_Callback>> frame_callback{}; /* Scene 结束借用后的唯一完成通知。 */
     std::unique_ptr<Task_Graph> frame_taskflow{};
     ~Private();
-    Frame_2D* active_frame{};                                /* 异步帧 DAG 借用的外部帧；完成回调前保持存活。 */
-    Blend2D_Cache* frame_target{};                            /* 当前异步帧的最终颜色层；帧 DAG 完成后清空。 */
+    std::optional<not_null<Frame_2D*>> active_frame{};        /* 异步帧 DAG 借用的外部帧；完成回调前保持存活。 */
+    std::optional<not_null<Blend2D_Cache*>> frame_target{};   /* 当前异步帧的最终颜色层；帧 DAG 完成后清空。 */
     /* 最终 Private 实现：Prepare 完成后按 Paint 图拓扑边并行绘制并合成颜色层。 */
     std::vector<Paint_Node> paint_order{};                    /* Paint 图当前拓扑序及 Scene 缓存分组结果。 */
     std::vector<Cache_Group> cache_groups{};                  /* 仅保存显式缓存根对应的执行分组。 */
@@ -80,9 +82,9 @@ struct Render_Scene_2D::Private : Prev_Private {
     void dispatch_events(Object* object, Size viewport,
                          std::uint64_t frame_sequence);
     template <Attached Object>
-    [[nodiscard]] std::expected<void, Render_Result> render(Object* object,
-                                                            Frame_2D* frame);
-    template <Attached Object> void set_frame_callback(Object* object, Frame_Callback callback);
+    [[nodiscard]] std::expected<void, Render_Result> render(
+        Object* object, not_null<Frame_2D*> frame,
+        Frame_Callback callback);
     template <Attached Object> void set_view_active(Object* object, bool active);
     template <Attached Object> void reset_diagnostics(Object* object);
     /* CRTP 覆盖：Builder 挂接最终 Private 后安装二维 Scene 的无虚函数业务分派。 */
@@ -103,7 +105,7 @@ void Render_Scene_2D::Private::after_advance(
         const bool enabled = node.private_data->cache_enabled &&
                              node.private_data->cache_enabled(node.object);
         if (enabled == (node.cache_owner == node.object)) continue;
-        node.private_data->valid_cache = nullptr;
+        node.private_data->valid_cache.reset();
         rebuild = true;
     }
     if (!rebuild) return;
@@ -112,27 +114,28 @@ void Render_Scene_2D::Private::after_advance(
         double_buffer::detail::Internal_Access::current_dependency_graph<Render_Graph_Tag>(object);
     paint_order.clear();
     cache_groups.clear();
-    std::unordered_map<Root*, Root*> cache_owner_by_object;
+    std::unordered_map<Root*, std::optional<not_null<Root*>>>
+        cache_owner_by_object;
     std::unordered_map<Root*, std::size_t> cache_group_by_owner;
     const auto order_result = dependencies.for_each_topological_view(
         [&](const auto& view, const Dependency_Graph::Node& node) {
             auto* base_data = view.private_data(node);
             if (!base_data) return;
-            auto* data =
-                static_cast<Renderable_2D_Base::Private*>(base_data);
-            Root* cache_owner{};
+            const not_null data{
+                static_cast<Renderable_2D_Base::Private*>(base_data)};
+            std::optional<not_null<Root*>> cache_owner{};
             if (data->cache_enabled && data->cache_enabled(node.object)) {
                 cache_owner = node.object;
             }
             else {
                 bool conflict{};
-                for (const auto* dependency : node.dependencies) {
+                for (const auto dependency : node.dependencies) {
                     if (!view.private_data(*dependency)) continue;
                     const auto current =
-                        cache_owner_by_object.find(dependency->object);
-                    Root* dependency_owner =
+                        cache_owner_by_object.find(dependency->object.get());
+                    const auto dependency_owner =
                         current == cache_owner_by_object.end()
-                            ? nullptr
+                            ? std::optional<not_null<Root*>>{}
                             : current->second;
                     if (!dependency_owner ||
                         (cache_owner && cache_owner != dependency_owner)) {
@@ -141,15 +144,16 @@ void Render_Scene_2D::Private::after_advance(
                     }
                     cache_owner = dependency_owner;
                 }
-                if (conflict) cache_owner = nullptr;
+                if (conflict) cache_owner.reset();
             }
-            cache_owner_by_object.emplace(node.object, cache_owner);
+            cache_owner_by_object.emplace(node.object.get(), cache_owner);
             paint_order.push_back(
                 Paint_Node{node.object, data, cache_owner, false});
             if (!cache_owner) return;
             auto [group, inserted] =
-                cache_group_by_owner.emplace(cache_owner, cache_groups.size());
-            if (inserted) cache_groups.push_back(Cache_Group{cache_owner});
+                cache_group_by_owner.emplace(
+                    cache_owner->get(), cache_groups.size());
+            if (inserted) cache_groups.push_back(Cache_Group{*cache_owner});
             cache_groups[group->second].members.push_back(node.object);
         });
     if (!order_result)
@@ -162,24 +166,27 @@ void Render_Scene_2D::Private::prepare_paint_targets(Object*, Blend2D_Cache& fra
         const auto owner_node = std::find_if(paint_order.begin(), paint_order.end(), [&](const Paint_Node& value) { return value.object == group.owner; });
         if (owner_node == paint_order.end() || !owner_node->private_data->pending_cache)
             throw std::logic_error("2D cache group lost its cache owner capability");
-        group.rebuild = owner_node->private_data->valid_cache == nullptr;
-        for (Root* member : group.members) {
+        group.rebuild = !owner_node->private_data->valid_cache;
+        for (const auto member : group.members) {
             const auto node = std::find_if(paint_order.begin(), paint_order.end(), [member](const Paint_Node& value) { return value.object == member; });
             if (node == paint_order.end()) continue;
             group.rebuild = group.rebuild ||
-                double_buffer::detail::Internal_Access::dirty<Render_Graph_Tag>(member);
+                double_buffer::detail::Internal_Access::dirty<Render_Graph_Tag>(
+                    member.get());
         }
         if (group.rebuild) {
-            auto* target = owner_node->private_data->pending_cache(group.owner);
+            const not_null target{
+                owner_node->private_data->pending_cache(group.owner)};
             target->ensure_size(viewport);
             target->clear();
-            for (Root* member : group.members) {
-                double_buffer::detail::Internal_Access::mark_dirty<Render_Graph_Tag>(member);
+            for (const auto member : group.members) {
+                double_buffer::detail::Internal_Access::mark_dirty<Render_Graph_Tag>(
+                    member.get());
                 const auto node = std::find_if(paint_order.begin(), paint_order.end(), [member](const Paint_Node& value) { return value.object == member; });
                 if (node != paint_order.end()) { node->private_data->paint_target = target; node->paint_requested = true; }
             }
         } else {
-            for (Root* member : group.members) {
+            for (const auto member : group.members) {
                 const auto node = std::find_if(paint_order.begin(), paint_order.end(), [member](const Paint_Node& value) { return value.object == member; });
                 if (node != paint_order.end()) {
                     node->private_data->paint_target = owner_node->private_data->valid_cache;
@@ -192,7 +199,8 @@ void Render_Scene_2D::Private::prepare_paint_targets(Object*, Blend2D_Cache& fra
         if (node.cache_owner) continue;
         node.private_data->paint_target = &frame;
         node.paint_requested = true;
-        double_buffer::detail::Internal_Access::mark_dirty<Render_Graph_Tag>(node.object);
+        double_buffer::detail::Internal_Access::mark_dirty<Render_Graph_Tag>(
+            node.object.get());
     }
 }
 template <Attached Object>
@@ -205,8 +213,9 @@ void Render_Scene_2D::Private::ensure_frame_taskflow(Object* object) {
     graph.describe("owner_kind", "scene")
          .describe("owner_component", "scene");
     auto begin = graph.add("scene.begin", [this, object] {
-        auto* frame = active_frame;
-        if (!frame) throw std::logic_error("2D frame DAG lost its active frame");
+        if (!active_frame)
+            throw std::logic_error("2D frame DAG lost its active frame");
+        const auto frame = *active_frame;
         const Prop& prop =
             double_buffer::detail::Internal_Access::current_prop_layer<
                 Render_Scene_2D::Base_Tag>(object);
@@ -218,10 +227,10 @@ void Render_Scene_2D::Private::ensure_frame_taskflow(Object* object) {
             current_dependency_graph<Render_Cache_Tag>(object).for_each(
                 [](const Dependency_Graph::Node& node) {
                     if (!double_buffer::detail::Internal_Access::
-                            take_dirty<Render_Cache_Tag>(node.object))
+                            take_dirty<Render_Cache_Tag>(node.object.get()))
                         return;
                     double_buffer::detail::Internal_Access::
-                        mark_dirty<Render_Graph_Tag>(node.object);
+                        mark_dirty<Render_Graph_Tag>(node.object.get());
                 });
         auto& state = static_cast<State&>(
             double_buffer::detail::Internal_Access::pending_state(object));
@@ -233,28 +242,28 @@ void Render_Scene_2D::Private::ensure_frame_taskflow(Object* object) {
 
     auto prepare_frame_target = graph.add(
         "scene.frame_target", [this, object] {
-            auto* frame = active_frame;
-            if (!frame || !frame_target)
+            if (!active_frame || !frame_target)
                 throw std::logic_error("2D frame target lost its frame");
+            const auto frame = *active_frame;
             const Prop& prop =
                 double_buffer::detail::Internal_Access::current_prop_layer<
                     Render_Scene_2D::Base_Tag>(object);
             frame->mark(Frame_Trace_Marker::paint_frame_target_started);
-            frame_target->ensure_size(prop.viewport);
-            frame_target->clear();
+            (*frame_target)->ensure_size(prop.viewport);
+            (*frame_target)->clear();
             frame->mark(Frame_Trace_Marker::paint_frame_target_finished);
         });
     auto paint_background = graph.add(
         "scene.background", [this, object] {
-            auto* frame = active_frame;
-            if (!frame || !frame_target)
+            if (!active_frame || !frame_target)
                 throw std::logic_error("2D background lost its frame target");
+            const auto frame = *active_frame;
             const Prop& prop =
                 double_buffer::detail::Internal_Access::current_prop_layer<
                     Render_Scene_2D::Base_Tag>(object);
             frame->mark(Frame_Trace_Marker::paint_background_started);
             {
-                detail::Painter painter(*frame_target, prop.viewport);
+                detail::Painter painter(**frame_target, prop.viewport);
                 painter.rect(
                     {0.0, 0.0, static_cast<double>(prop.viewport.width),
                      static_cast<double>(prop.viewport.height)},
@@ -265,22 +274,22 @@ void Render_Scene_2D::Private::ensure_frame_taskflow(Object* object) {
         });
     auto prepare_cache_targets = graph.add(
         "scene.cache_targets", [this, object] {
-            auto* frame = active_frame;
-            if (!frame || !frame_target)
+            if (!active_frame || !frame_target)
                 throw std::logic_error("2D cache setup lost its frame");
+            const auto frame = *active_frame;
             const Prop& prop =
                 double_buffer::detail::Internal_Access::current_prop_layer<
                     Render_Scene_2D::Base_Tag>(object);
             frame->mark(Frame_Trace_Marker::paint_cache_targets_started);
-            prepare_paint_targets(object, *frame_target, prop.viewport);
+            prepare_paint_targets(object, **frame_target, prop.viewport);
             frame->mark(Frame_Trace_Marker::paint_cache_targets_finished);
         });
     auto render_ready = graph.add("scene.render.ready", [this] {
         if (!active_frame)
             throw std::logic_error("2D render lost its active frame");
-        active_frame->mark(Frame_Trace_Marker::prepare_finished);
-        active_frame->mark(Frame_Trace_Marker::paint_started);
-        active_frame->mark(Frame_Trace_Marker::paint_taskflow_started);
+        (*active_frame)->mark(Frame_Trace_Marker::prepare_finished);
+        (*active_frame)->mark(Frame_Trace_Marker::paint_started);
+        (*active_frame)->mark(Frame_Trace_Marker::paint_taskflow_started);
     });
     auto renderables = graph.compose("scene.renderables", *runtime->taskflow);
     renderables.describe("dimension", "2D").describe("backend", "Blend2D");
@@ -298,16 +307,16 @@ void Render_Scene_2D::Private::ensure_frame_taskflow(Object* object) {
                 owner->private_data->valid_cache =
                     owner->private_data->paint_target;
             if (owner->private_data->valid_cache)
-                frame_target->composite(*owner->private_data->valid_cache);
+                (*frame_target)->composite(**owner->private_data->valid_cache);
         }
     });
     auto finish = graph.add("scene.render.complete", [this, object] {
         auto& state = static_cast<State&>(
             double_buffer::detail::Internal_Access::pending_state(object));
         state.event_statistics = event_statistics.state();
-        active_frame->mark(Frame_Trace_Marker::paint_taskflow_finished);
-        active_frame->mark(Frame_Trace_Marker::paint_finished);
-        active_frame->mark(Frame_Trace_Marker::scene_render_finished);
+        (*active_frame)->mark(Frame_Trace_Marker::paint_taskflow_finished);
+        (*active_frame)->mark(Frame_Trace_Marker::paint_finished);
+        (*active_frame)->mark(Frame_Trace_Marker::scene_render_finished);
     });
     auto completion = graph.compose("scene.completion", completion_graph);
     completion.describe("owner", "scene").describe("stage", "frame consumers");
@@ -324,13 +333,11 @@ void Render_Scene_2D::Private::ensure_frame_taskflow(Object* object) {
 }
 template <Attached Object>
 std::expected<void, Render_Scene_2D::Render_Result>
-Render_Scene_2D::Private::render(Object* object, Frame_2D* frame) {
-    if (!frame)
-        throw std::invalid_argument(
-            "Render_Scene_2D requires a non-null external frame");
+Render_Scene_2D::Private::render(
+    Object* object, not_null<Frame_2D*> frame,
+    Frame_Callback callback) {
     frame->mark(Frame_Trace_Marker::scene_render_entered);
-    const auto callback = frame_callback.load(std::memory_order_acquire);
-    if (!callback || !*callback)
+    if (!callback)
         throw std::logic_error(
             "Render_Scene_2D requires a frame callback before render");
     bool available{};
@@ -363,7 +370,7 @@ Render_Scene_2D::Private::render(Object* object, Frame_2D* frame) {
             return std::unexpected(Render_Result::empty_viewport);
         }
         ensure_frame_taskflow(object);
-        active_frame = frame;
+        active_frame = frame.get();
     }
     catch (...) {
         release_admission();
@@ -372,7 +379,8 @@ Render_Scene_2D::Private::render(Object* object, Frame_2D* frame) {
     frame->mark(Frame_Trace_Marker::scene_render_requested);
     const bool trace_started = aethera::detail::begin_taskflow_trace(*frame);
     try {
-        auto completion = [this, object, frame, callback,
+        auto completion = [this, object, frame,
+                           callback = std::move(callback),
                            trace_started]() mutable {
             /*
              * render_2d.frame 的原生 Taskflow 已经完成。先发布 Scene 自身状态、
@@ -388,10 +396,10 @@ Render_Scene_2D::Private::render(Object* object, Frame_2D* frame) {
             frame->mark(Frame_Trace_Marker::frame_ready);
             if (trace_started)
                 aethera::detail::finish_taskflow_trace(*frame);
-            active_frame = nullptr;
-            frame_target = nullptr;
+            active_frame.reset();
+            frame_target.reset();
             frame_in_flight.store(false, std::memory_order_release);
-            (*callback)(frame);
+            callback(frame);
         };
         if (frame->taskflow_trace_requested())
             aethera::detail::run_taskflow(
@@ -402,8 +410,8 @@ Render_Scene_2D::Private::render(Object* object, Frame_2D* frame) {
     catch (...) {
         if (trace_started)
             aethera::detail::finish_taskflow_trace(*frame);
-        active_frame = nullptr;
-        frame_target = nullptr;
+        active_frame.reset();
+        frame_target.reset();
         frame_in_flight.store(false, std::memory_order_release);
         throw;
     }
@@ -470,14 +478,6 @@ void Render_Scene_2D::Private::reset_diagnostics(Object* object) {
         });
 }
 template <Attached Object>
-void Render_Scene_2D::Private::set_frame_callback(Object*, Frame_Callback callback) {
-    frame_callback.store(
-        callback
-            ? std::make_shared<const Frame_Callback>(std::move(callback))
-            : std::shared_ptr<const Frame_Callback>{},
-        std::memory_order_release);
-}
-template <Attached Object>
 void Render_Scene_2D::Private::set_view_active(Object* object, bool active) {
     double_buffer::detail::Internal_Access::set<&Prop::view_active>(object, active);
 }
diff --git a/render_2D/tests/Async_Render_Contract_Test.cpp b/render_2D/tests/Async_Render_Contract_Test.cpp
index 99dab29..14a66c9 100644
--- a/render_2D/tests/Async_Render_Contract_Test.cpp
+++ b/render_2D/tests/Async_Render_Contract_Test.cpp
@@ -17,7 +17,7 @@ using namespace aethera;
 using namespace aethera::render_2d;
 
 template <typename Object, typename... Arguments>
-Object* build_object(Arguments&&... arguments) {
+owner<Object*> build_object(Arguments&&... arguments) {
     typename Object::template Builder<Object> builder(std::forward<Arguments>(arguments)...);
     auto result = builder.build();
     if (!result) std::_Exit(2);
@@ -27,7 +27,7 @@ Object* build_object(Arguments&&... arguments) {
 bool contains_color(Image_View view) {
     for (int y = 0; y < view.height; ++y) {
         const auto* row = reinterpret_cast<const Pixel*>(
-            view.data + static_cast<std::ptrdiff_t>(y) * view.stride);
+            view.data.data() + static_cast<std::ptrdiff_t>(y) * view.stride);
         for (int x = 0; x < view.width; ++x)
             if (row[x] != 0) return true;
     }
@@ -48,15 +48,16 @@ int main() {
     initialize_runtime({.workers = 4});
     auto* frequency = build_object<Frequency>();
     auto* power = build_object<Power>();
-    auto* spectrum = build_object<Spectrum_Object>(frequency, power, 4u);
+    auto* spectrum = build_object<Spectrum_Object>(
+        not_null{frequency}, not_null{power}, 4u);
     auto* time = build_object<Time>();
     auto* waterfall = build_object<Waterfall_Object>(
-        frequency, time, Plot_Partition_Grid{2, 2});
+        not_null{frequency}, not_null{time}, Plot_Partition_Grid{2, 2});
     auto* afterglow = build_object<Afterglow_Object>(
-        frequency, power, Plot_Partition_Grid{2, 2});
+        not_null{frequency}, not_null{power}, Plot_Partition_Grid{2, 2});
     auto* q_axis = build_object<Power>();
     auto* constellation = build_object<Constellation_Object>(
-        power, q_axis, 3u);
+        not_null{power}, not_null{q_axis}, 3u);
     auto* spectrum_painted = new std::atomic_bool{};
     auto* topology_valid = new std::atomic_bool{true};
     auto* second_frame_valid = new std::atomic_bool{};
@@ -75,10 +76,10 @@ int main() {
                                 verify_spectrum_precedes_axis);
 
     typename Scene_Object::template Builder<Scene_Object> scene_builder;
-    scene_builder.add_renderable(spectrum);
-    scene_builder.add_renderable(waterfall);
-    scene_builder.add_renderable(afterglow);
-    scene_builder.add_renderable(constellation);
+    scene_builder.add_renderable(not_null{spectrum});
+    scene_builder.add_renderable(not_null{waterfall});
+    scene_builder.add_renderable(not_null{afterglow});
+    scene_builder.add_renderable(not_null{constellation});
     auto scene_result = scene_builder.build();
     if (!scene_result) return 2;
     auto* scene = std::move(scene_result).value().release();
@@ -157,12 +158,13 @@ int main() {
             !afterglow_color_barrier)
             trace_valid->store(false, std::memory_order_relaxed);
     };
-    scene->set_frame_callback(
+    if (!scene->render(
+        frame,
         [scene, spectrum, waterfall, afterglow, constellation, frame,
          resized_partition_frame, spectrum_painted,
          topology_valid, second_frame_valid, trace_valid,
-         validate_trace](Frame_2D* completed) {
-            const bool valid = completed == frame &&
+         validate_trace](not_null<Frame_2D*> completed) {
+            const bool valid = completed.get() == frame &&
                 spectrum->read_state<Spectrum::Base_Tag>().sample_count ==
                     512 &&
                 topology_valid->load(std::memory_order_relaxed) &&
@@ -181,12 +183,13 @@ int main() {
             constellation->set<
                 &Constellation_Diagram::Prop::partition_count>(2u);
             spectrum_painted->store(false, std::memory_order_relaxed);
-            scene->set_frame_callback(
+            if (!scene->render(
+                resized_partition_frame,
                 [resized_partition_frame, second_frame_valid,
                  topology_valid, trace_valid,
-                 validate_trace](Frame_2D* next) {
+                 validate_trace](not_null<Frame_2D*> next) {
                     const bool resized_valid =
-                        next == resized_partition_frame &&
+                        next.get() == resized_partition_frame &&
                         topology_valid->load(std::memory_order_relaxed) &&
                         contains_color(next->image());
                     second_frame_valid->store(resized_valid,
@@ -197,10 +200,10 @@ int main() {
                                 trace_valid->load(std::memory_order_relaxed)
                             ? 0
                             : 1);
-                });
-            if (!scene->render(resized_partition_frame)) std::_Exit(2);
-        });
-    if (!scene->render(frame)) return 2;
+                }))
+                std::_Exit(2);
+        }))
+        return 2;
 
     /*
      * render() 是异步入口。结束提交线程但保持 Taskflow worker 和进程存活，
diff --git a/render_2D/tests/Axis_Test.cpp b/render_2D/tests/Axis_Test.cpp
index bd824e3..1d81777 100644
--- a/render_2D/tests/Axis_Test.cpp
+++ b/render_2D/tests/Axis_Test.cpp
@@ -17,8 +17,8 @@ template <typename Scene>
 std::unique_ptr<Frame_2D> render_frame(Scene* scene) {
     static std::uint64_t sequence{1};
     auto frame = std::make_unique<Frame_2D>(Frame_Identity{sequence++, 0});
-    scene->set_frame_callback([](Frame_2D*) {});
-    EXPECT_TRUE(scene->render(frame.get()).has_value());
+    EXPECT_TRUE(scene->render(
+        frame.get(), [](not_null<Frame_2D*>) {}).has_value());
     return frame;
 }
 template <typename Scene>
@@ -74,7 +74,7 @@ TEST(render_cache, copy_owns_independent_pixels) {
     ASSERT_FALSE(view.empty());
     bool contains_color{};
     for (int y = 0; y < view.height && !contains_color; ++y) {
-        const auto* row = reinterpret_cast<const Pixel*>(view.data + static_cast<std::ptrdiff_t>(y) * view.stride);
+        const auto* row = reinterpret_cast<const Pixel*>(view.data.data() + static_cast<std::ptrdiff_t>(y) * view.stride);
         for (int x = 0; x < view.width; ++x) contains_color = contains_color || row[x] != 0;
     }
     EXPECT_TRUE(contains_color);
@@ -107,7 +107,7 @@ TEST(axis_render, scene_prepares_and_paints_uncached_axis_into_frame) {
     ASSERT_FALSE(view.empty());
     bool contains_color{};
     for (int y = 0; y < view.height && !contains_color; ++y) {
-        const auto* row = reinterpret_cast<const Pixel*>(view.data + static_cast<std::ptrdiff_t>(y) * view.stride);
+        const auto* row = reinterpret_cast<const Pixel*>(view.data.data() + static_cast<std::ptrdiff_t>(y) * view.stride);
         for (int x = 0; x < view.width; ++x) contains_color = contains_color || row[x] != 0;
     }
     EXPECT_TRUE(contains_color);
diff --git a/render_2D/tests/Frame_Pixel_Format_Test.cpp b/render_2D/tests/Frame_Pixel_Format_Test.cpp
index 9b7b806..f8e60e2 100644
--- a/render_2D/tests/Frame_Pixel_Format_Test.cpp
+++ b/render_2D/tests/Frame_Pixel_Format_Test.cpp
@@ -48,7 +48,7 @@ TEST(framebuffer_view, writes_only_the_requested_external_image_region) {
     ASSERT_EQ(view.height, 6);
     for (int y = 0; y < view.height; ++y) {
         const auto* row = reinterpret_cast<const Pixel*>(
-            view.data + static_cast<std::ptrdiff_t>(y) * view.stride);
+            view.data.data() + static_cast<std::ptrdiff_t>(y) * view.stride);
         for (int x = 0; x < view.width; ++x) {
             const bool inside = x >= 2 && x < 5 && y >= 1 && y < 3;
             EXPECT_EQ(row[x] != 0, inside) << "pixel " << x << ',' << y;
@@ -75,7 +75,7 @@ TEST(framebuffer_view, overlapping_views_share_the_same_authoritative_pixels) {
     const Image_View view = framebuffer.view();
     const auto pixel = [&](int x, int y) {
         const auto* row = reinterpret_cast<const Pixel*>(
-            view.data + static_cast<std::ptrdiff_t>(y) * view.stride);
+            view.data.data() + static_cast<std::ptrdiff_t>(y) * view.stride);
         return row[x];
     };
     EXPECT_NE(pixel(2, 2), 0u);
diff --git a/render_2D/tests/Partition_Configuration_Test.cpp b/render_2D/tests/Partition_Configuration_Test.cpp
index d2ac2a9..7bc603e 100644
--- a/render_2D/tests/Partition_Configuration_Test.cpp
+++ b/render_2D/tests/Partition_Configuration_Test.cpp
@@ -39,16 +39,21 @@ TEST(partition_configuration,
     auto power = build_object<Power>();
     auto q_axis = build_object<Power>();
     auto time = build_object<Time>();
-    auto spectrum = build_object<Spectrum_Object>(frequency.get(), power.get(),
+    auto spectrum = build_object<Spectrum_Object>(not_null{frequency.get()},
+                                                  not_null{power.get()},
                                                   6u);
-    auto trace = build_object<Trace_Object>(time.get(), power.get(), 4u);
-    auto sweep = build_object<Sweep_Object>(frequency.get(), power.get(), 4u);
+    auto trace = build_object<Trace_Object>(not_null{time.get()},
+                                            not_null{power.get()}, 4u);
+    auto sweep = build_object<Sweep_Object>(not_null{frequency.get()},
+                                            not_null{power.get()}, 4u);
     auto afterglow = build_object<Afterglow_Object>(
-        frequency.get(), power.get(), Plot_Partition_Grid{2, 3});
+        not_null{frequency.get()}, not_null{power.get()},
+        Plot_Partition_Grid{2, 3});
     auto constellation = build_object<Constellation_Object>(
-        power.get(), q_axis.get(), 7u);
+        not_null{power.get()}, not_null{q_axis.get()}, 7u);
     auto waterfall = build_object<Waterfall_Object>(
-        frequency.get(), time.get(), Plot_Partition_Grid{2, 3});
+        not_null{frequency.get()}, not_null{time.get()},
+        Plot_Partition_Grid{2, 3});
 
     EXPECT_EQ(spectrum->read_prop<Spectrum::Base_Tag>().partition_count, 6u);
     EXPECT_EQ(constellation->read_prop<Constellation_Diagram::Base_Tag>()
@@ -132,9 +137,9 @@ TEST(partition_configuration,
     ASSERT_EQ(actual.height, expected.height);
     for (int y = 0; y < expected.height; ++y) {
         const auto* expected_row = reinterpret_cast<const Pixel*>(
-            expected.data + static_cast<std::ptrdiff_t>(y) * expected.stride);
+            expected.data.data() + static_cast<std::ptrdiff_t>(y) * expected.stride);
         const auto* actual_row = reinterpret_cast<const Pixel*>(
-            actual.data + static_cast<std::ptrdiff_t>(y) * actual.stride);
+            actual.data.data() + static_cast<std::ptrdiff_t>(y) * actual.stride);
         for (int x = 0; x < expected.width; ++x)
             EXPECT_EQ(actual_row[x], expected_row[x])
                 << "pixel mismatch at " << x << ", " << y;
@@ -207,9 +212,9 @@ TEST(partition_configuration,
     const Image_View actual = actual_cache.view();
     for (int y = 0; y < expected.height; ++y) {
         const auto* expected_row = reinterpret_cast<const Pixel*>(
-            expected.data + static_cast<std::ptrdiff_t>(y) * expected.stride);
+            expected.data.data() + static_cast<std::ptrdiff_t>(y) * expected.stride);
         const auto* actual_row = reinterpret_cast<const Pixel*>(
-            actual.data + static_cast<std::ptrdiff_t>(y) * actual.stride);
+            actual.data.data() + static_cast<std::ptrdiff_t>(y) * actual.stride);
         for (int x = 0; x < expected.width; ++x)
             EXPECT_EQ(actual_row[x], expected_row[x])
                 << "tile seam mismatch at " << x << ", " << y;
diff --git a/render_2D/tests/Plottable_Migration_Test.cpp b/render_2D/tests/Plottable_Migration_Test.cpp
index 13dc73e..b5928ba 100644
--- a/render_2D/tests/Plottable_Migration_Test.cpp
+++ b/render_2D/tests/Plottable_Migration_Test.cpp
@@ -19,7 +19,7 @@ std::unique_ptr<Object> build_object(Args&&... args) {
 template <typename Scene, typename... Renderables>
 std::unique_ptr<Scene> build_scene(Renderables*... renderables) {
     typename Scene::template Builder<Scene> builder;
-    (builder.add_renderable(renderables), ...);
+    (builder.add_renderable(not_null{renderables}), ...);
     auto result = builder.build();
     if (!result) std::terminate();
     return std::move(result).value();
@@ -35,8 +35,8 @@ template <typename Scene>
 void render_once(Scene* scene) {
     static std::uint64_t sequence{1};
     Frame_2D frame{Frame_Identity{sequence++, 0}};
-    scene->set_frame_callback([](Frame_2D*) {});
-    EXPECT_TRUE(scene->render(&frame).has_value());
+    EXPECT_TRUE(scene->render(
+        &frame, [](not_null<Frame_2D*>) {}).has_value());
 }
 }
 
@@ -60,8 +60,10 @@ TEST(plottable_migration, curve_plots_share_partitioned_rendering) {
     frequency->set<&Numeric_Axis::Prop::coordinate_range>(Axis_Range{0.0, 100.0});
     power->set<&Numeric_Axis::Prop::coordinate_range>(Axis_Range{-100.0, 0.0});
     value->set<&Numeric_Axis::Prop::coordinate_range>(Axis_Range{0.0, 100.0});
-    auto trace = build_object<Trace>(time.get(), value.get(), 2u);
-    auto sweep = build_object<Sweep>(frequency.get(), power.get(), 2u);
+    auto trace = build_object<Trace>(not_null{time.get()},
+                                     not_null{value.get()}, 2u);
+    auto sweep = build_object<Sweep>(not_null{frequency.get()},
+                                     not_null{power.get()}, 2u);
     trace->submit_stream<Frequency_Trace_Stream_Tag>(
         Frequency_Trace_Sample{time->append_time({1'000}), 10.0});
     trace->submit_stream<Frequency_Trace_Stream_Tag>(
@@ -120,9 +122,11 @@ TEST(plottable_migration, raster_plots_share_partitioned_color_blocks) {
     configure_axis(time.get(), Axis_Orientation::vertical, {20.0, 100.0}, -80.0, canvas);
     frequency->set<&Numeric_Axis::Prop::coordinate_range>(Axis_Range{0.0, 100.0});
     power->set<&Numeric_Axis::Prop::coordinate_range>(Axis_Range{-100.0, 0.0});
-    auto glow = build_object<Glow>(frequency.get(), power.get(),
+    auto glow = build_object<Glow>(not_null{frequency.get()},
+                                   not_null{power.get()},
                                    Plot_Partition_Grid{2, 2});
-    auto waterfall = build_object<Fall>(frequency.get(), time.get(),
+    auto waterfall = build_object<Fall>(not_null{frequency.get()},
+                                        not_null{time.get()},
                                         Plot_Partition_Grid{2, 2});
     glow->set<&Afterglow::Prop::frequency_range>(Axis_Range{0.0, 100.0});
     glow->set<&Afterglow::Prop::power_range>(Axis_Range{-100.0, 0.0});
@@ -172,8 +176,10 @@ TEST(plottable_migration, direct_overlay_and_constellation_build_and_render) {
     configure_axis(vertical.get(), Axis_Orientation::vertical, {20.0, 100.0}, -80.0, canvas);
     horizontal->set<&Numeric_Axis::Prop::coordinate_range>(Axis_Range{-1.0, 1.0});
     vertical->set<&Numeric_Axis::Prop::coordinate_range>(Axis_Range{-1.0, 1.0});
-    auto diagram = build_object<Diagram>(horizontal.get(), vertical.get(), 2u);
-    auto overlay = build_object<Overlay>(horizontal.get(), vertical.get());
+    auto diagram = build_object<Diagram>(not_null{horizontal.get()},
+                                         not_null{vertical.get()}, 2u);
+    auto overlay = build_object<Overlay>(not_null{horizontal.get()},
+                                         not_null{vertical.get()});
     diagram->set<&Constellation_Diagram::Prop::i_range>(Axis_Range{-1.0, 1.0});
     diagram->set<&Constellation_Diagram::Prop::q_range>(Axis_Range{-1.0, 1.0});
     diagram->submit_stream<Constellation_Stream_Tag>(
@@ -199,7 +205,8 @@ TEST(selection_overlay, control_extends_selection_and_plain_click_clears_it) {
     configure_axis(vertical.get(), Axis_Orientation::vertical, {20.0, 100.0}, -80.0, canvas);
     horizontal->set<&Numeric_Axis::Prop::coordinate_range>(Axis_Range{0.0, 100.0});
     vertical->set<&Numeric_Axis::Prop::coordinate_range>(Axis_Range{0.0, 100.0});
-    auto overlay = build_object<Overlay>(horizontal.get(), vertical.get());
+    auto overlay = build_object<Overlay>(not_null{horizontal.get()},
+                                         not_null{vertical.get()});
     auto scene = build_scene<Scene>(overlay.get());
     scene->set<&Render_Scene_2D::Prop::viewport>(canvas);
     scene->activate_view();
@@ -246,7 +253,8 @@ TEST(selection_overlay, time_axis_selection_keeps_axis_coordinates_while_window_
     time->append_time({1'000});
     time->append_time({2'000});
     time->append_time({3'000});
-    auto overlay = build_object<Overlay>(time.get(), value.get());
+    auto overlay = build_object<Overlay>(not_null{time.get()},
+                                         not_null{value.get()});
     auto scene = build_scene<Scene>(overlay.get());
     scene->set<&Render_Scene_2D::Prop::viewport>(canvas);
     scene->activate_view();
diff --git a/render_2D/tests/Spectrum_Test.cpp b/render_2D/tests/Spectrum_Test.cpp
index 7905f71..e4e0c68 100644
--- a/render_2D/tests/Spectrum_Test.cpp
+++ b/render_2D/tests/Spectrum_Test.cpp
@@ -15,14 +15,14 @@ std::unique_ptr<Object> build_object(Args&&... args) {
 template <typename Scene, typename... Renderables>
 std::unique_ptr<Scene> build_scene(Renderables*... renderables) {
     typename Scene::template Builder<Scene> builder;
-    (builder.add_renderable(renderables), ...);
+    (builder.add_renderable(not_null{renderables}), ...);
     auto result = builder.build();
     if (!result) std::terminate();
     return std::move(result).value();
 }
 bool contains_color(Image_View view) {
     for (int y = 0; y < view.height; ++y) {
-        const auto* row = reinterpret_cast<const Pixel*>(view.data + static_cast<std::ptrdiff_t>(y) * view.stride);
+        const auto* row = reinterpret_cast<const Pixel*>(view.data.data() + static_cast<std::ptrdiff_t>(y) * view.stride);
         for (int x = 0; x < view.width; ++x)
             if (row[x] != 0) return true;
     }
@@ -31,7 +31,7 @@ bool contains_color(Image_View view) {
 std::uint64_t image_hash(Image_View view) {
     std::uint64_t value{1469598103934665603ULL};
     for (int y = 0; y < view.height; ++y) {
-        const auto* row = reinterpret_cast<const std::byte*>(view.data) +
+        const auto* row = view.data.data() +
                           static_cast<std::ptrdiff_t>(y) * view.stride;
         for (std::ptrdiff_t index = 0;
              index < static_cast<std::ptrdiff_t>(view.width * sizeof(Pixel));
@@ -46,8 +46,8 @@ template <typename Scene>
 std::unique_ptr<Frame_2D> render_frame(Scene* scene) {
     static std::uint64_t sequence{1};
     auto frame = std::make_unique<Frame_2D>(Frame_Identity{sequence++, 0});
-    scene->set_frame_callback([](Frame_2D*) {});
-    EXPECT_TRUE(scene->render(frame.get()).has_value());
+    EXPECT_TRUE(scene->render(
+        frame.get(), [](not_null<Frame_2D*>) {}).has_value());
     return frame;
 }
 }
@@ -58,7 +58,8 @@ TEST(spectrum_data, publishes_samples_through_tagged_frame_buffer) {
     using Scene_Object = Render_Scene_2D;
     auto frequency = build_object<Frequency>();
     auto power = build_object<Power>();
-    auto spectrum = build_object<Object>(frequency.get(), power.get());
+    auto spectrum = build_object<Object>(not_null{frequency.get()},
+                                         not_null{power.get()});
     spectrum->set<&Spectrum::Prop::frequency_range>(Axis_Range{0.0, 100.0});
     const double samples[]{-100.0, -50.0, 0.0};
     spectrum->pending_buffer<Spectrum_Frame_Tag>() =
@@ -75,7 +76,8 @@ TEST(spectrum_markers, uses_tagged_properties_as_the_only_marker_interface) {
     using Scene_Object = Render_Scene_2D;
     auto frequency = build_object<Frequency>();
     auto power = build_object<Power>();
-    auto spectrum = build_object<Object>(frequency.get(), power.get());
+    auto spectrum = build_object<Object>(not_null{frequency.get()},
+                                         not_null{power.get()});
     spectrum->set<&Spectrum::Prop::custom_markers>(
         std::vector<Spectrum_Frequency>{10.0, 20.0});
     spectrum->advance();
@@ -110,7 +112,8 @@ TEST(render_scene_2d, composites_axes_and_spectrum_into_final_frame) {
     initialize_runtime({.workers = 2});
     auto frequency = build_object<Frequency>();
     auto power = build_object<Power>();
-    auto spectrum = build_object<Spectrum_Object>(frequency.get(), power.get(), 3u);
+    auto spectrum = build_object<Spectrum_Object>(not_null{frequency.get()},
+                                                  not_null{power.get()}, 3u);
     auto scene = build_scene<Scene_Object>(spectrum.get());
     const Size canvas{160, 120};
     frequency->set<&Abs_Axis::Prop::position>(Point_F{20.0, 100.0});
@@ -188,7 +191,8 @@ TEST(spectrum_data, repeatedly_publishes_new_samples_during_long_running_render)
     initialize_runtime({.workers = 4});
     auto frequency = build_object<Frequency>();
     auto power = build_object<Power>();
-    auto spectrum = build_object<Spectrum_Object>(frequency.get(), power.get());
+    auto spectrum = build_object<Spectrum_Object>(not_null{frequency.get()},
+                                                  not_null{power.get()});
     auto scene = build_scene<Scene_Object>(spectrum.get());
     frequency->set<&Abs_Axis::Prop::position>(Point_F{20.0, 100.0});
     frequency->set<&Abs_Axis::Prop::pixel_length>(120.0);
diff --git a/render_3D/render_3D/base/Frame_3D.cpp b/render_3D/render_3D/base/Frame_3D.cpp
index 7bfc7b4..efd9e60 100644
--- a/render_3D/render_3D/base/Frame_3D.cpp
+++ b/render_3D/render_3D/base/Frame_3D.cpp
@@ -47,12 +47,10 @@ Frame_3D::take_datoviz_observation() {
     return std::exchange(d->datoviz_observation, {});
 }
 void detail::Frame_3D_Access::assign_pixels(
-    std::span<Frame_3D* const> frames, Extent extent,
+    std::span<const not_null<Frame_3D*>> frames, Extent extent,
     std::vector<std::byte> pixels, Frame_Identity rendered_identity) {
     auto shared_pixels = std::make_shared<const std::vector<std::byte>>(std::move(pixels));
-    for (Frame_3D* frame : frames) {
-        if (!frame)
-            throw std::invalid_argument("Render_Scene_3D requires non-null external frames");
+    for (const auto frame : frames) {
         frame->d->extent = extent;
         frame->d->rendered_identity = rendered_identity;
         frame->d->pixels = frame->d->output == Frame_3D_Output::pixels
@@ -60,9 +58,8 @@ void detail::Frame_3D_Access::assign_pixels(
                                : nullptr;
     }
 }
-void detail::Frame_3D_Access::share_pixels(Frame_3D* source, Frame_3D* target) {
-    if (!source || !target)
-        throw std::invalid_argument("Render_Scene_3D requires non-null external frames");
+void detail::Frame_3D_Access::share_pixels(
+    not_null<Frame_3D*> source, not_null<Frame_3D*> target) {
     target->d->extent = source->d->extent;
     target->d->rendered_identity = source->d->rendered_identity;
     target->d->pixels = target->d->output == Frame_3D_Output::pixels
@@ -70,10 +67,7 @@ void detail::Frame_3D_Access::share_pixels(Frame_3D* source, Frame_3D* target) {
                             : nullptr;
 }
 void detail::Frame_3D_Access::assign_datoviz_observation(
-    Frame_3D* frame, Datoviz_Frame_Observation observation) {
-    if (!frame)
-        throw std::invalid_argument(
-            "Render_Scene_3D requires a non-null observation frame");
+    not_null<Frame_3D*> frame, Datoviz_Frame_Observation observation) {
     frame->d->datoviz_observation.emplace(std::move(observation));
 }
 }
diff --git a/render_3D/render_3D/base/Frame_3D.hpp b/render_3D/render_3D/base/Frame_3D.hpp
index ef7aea0..47a7300 100644
--- a/render_3D/render_3D/base/Frame_3D.hpp
+++ b/render_3D/render_3D/base/Frame_3D.hpp
@@ -2,6 +2,7 @@
 #include "Datoviz_Frame_Observation.hpp"
 #include "Types.hpp"
 #include <frame.hpp>
+#include <ownership.hpp>
 #include <array>
 #include <memory>
 #include <optional>
@@ -15,12 +16,14 @@ enum struct Frame_3D_Output : std::uint8_t {
 struct Frame_3D;
 namespace detail {
 struct Frame_3D_Access {
-    static void assign_pixels(std::span<Frame_3D* const> frames, Extent extent,
+    static void assign_pixels(std::span<const not_null<Frame_3D*>> frames,
+                              Extent extent,
                               std::vector<std::byte> pixels,
                               Frame_Identity rendered_identity);
-    static void share_pixels(Frame_3D* source, Frame_3D* target);
+    static void share_pixels(not_null<Frame_3D*> source,
+                             not_null<Frame_3D*> target);
     static void assign_datoviz_observation(
-        Frame_3D* frame, Datoviz_Frame_Observation observation);
+        not_null<Frame_3D*> frame, Datoviz_Frame_Observation observation);
 };
 }
 struct Frame_3D final : public Render_Frame {
diff --git a/render_3D/render_3D/detail/Async_Render_Backend.cpp b/render_3D/render_3D/detail/Async_Render_Backend.cpp
index 3de9f10..51406e1 100644
--- a/render_3D/render_3D/detail/Async_Render_Backend.cpp
+++ b/render_3D/render_3D/detail/Async_Render_Backend.cpp
@@ -28,7 +28,7 @@ Mouse_Button held_button(Mouse_Button_Mask buttons) {
     return Mouse_Button::none;
 }
 void publish_datoviz_observation(
-    Frame_3D* frame, Datoviz_Frame_Observation observation) {
+    not_null<Frame_3D*> frame, Datoviz_Frame_Observation observation) {
     if (observation.apply_ns)
         frame->record(Frame_Trace_Measurement::backend_apply_ns,
                       observation.apply_ns);
@@ -100,7 +100,7 @@ struct Async_Render_Backend::Implementation
     };
     struct Pending {
         Datoviz_Visual_Backend::Pending_Frame backend_frame{}; /* 三缓冲目标对应的已录制提交。 */
-        Frame_3D* output{};                                 /* 调用方持有到 completed 返回同一地址。 */
+        not_null<Frame_3D*> output;                          /* 调用方拥有；后端借用到 completed 返回同一地址。 */
         std::optional<Gpu_Completion_Service::Reservation> completion_reservation{};
         Async_Render_Backend::Submitted submitted_callback{};
         Async_Render_Backend::Completed completed_callback{};
@@ -109,6 +109,8 @@ struct Async_Render_Backend::Implementation
         std::uint64_t domain_queue_wait_ns{}; /* Render Domain 消费入口一次写入。 */
         std::atomic_bool submitted{};                       /* 区分提交前取消与 GPU 已拥有资源后的终止。 */
         std::atomic_bool completion_enqueued{};              /* reservation 与提交失败只允许一个退休事实。 */
+
+        explicit Pending(not_null<Frame_3D*> frame) : output(frame) {}
     };
     struct Gpu_Completion {
         std::shared_ptr<Pending> pending{};                  /* 完成前保持后台目标、借用地址和回调集合。 */
@@ -162,7 +164,7 @@ struct Async_Render_Backend::Implementation
     void fail(std::exception_ptr value) noexcept;
     void render(
         Shared_Prepared_Visual_Batch visuals, Scene_3D_Parameters parameters,
-        Frame_3D* frame, Scene::Event_Batch events,
+        not_null<Frame_3D*> frame, Scene::Event_Batch events,
         Async_Render_Backend::Submitted submitted_callback,
         Async_Render_Backend::Completed completed_callback);
     void queue_prepare(Submission submission, std::shared_ptr<Pending> pending);
@@ -211,19 +213,16 @@ void Async_Render_Backend::Implementation::fail(
 }
 void Async_Render_Backend::Implementation::render(
     Shared_Prepared_Visual_Batch visuals, Scene_3D_Parameters parameters,
-    Frame_3D* frame, Scene::Event_Batch events,
+    not_null<Frame_3D*> frame, Scene::Event_Batch events,
     Async_Render_Backend::Submitted submitted_callback,
     Async_Render_Backend::Completed completed_callback) {
-    if (!frame)
-        throw std::invalid_argument("3D backend requires a non-null external frame");
     if (!visuals || visuals->empty())
         throw std::invalid_argument("3D backend requires prepared Visual data");
     if (!submitted_callback || !completed_callback)
         throw std::invalid_argument("3D backend requires a completion callback");
     if (!available.load(std::memory_order_acquire))
         throw std::runtime_error("3D backend is unavailable");
-    auto pending = std::make_shared<Pending>();
-    pending->output = frame;
+    auto pending = std::make_shared<Pending>(frame);
     pending->submitted_callback = std::move(submitted_callback);
     pending->completed_callback = std::move(completed_callback);
     auto self = shared_from_this();
@@ -509,7 +508,7 @@ void Async_Render_Backend::Implementation::dispatch(
 }
 void Async_Render_Backend::render(
     Shared_Prepared_Visual_Batch visuals, Scene_3D_Parameters parameters,
-    Frame_3D* frame, Scene::Event_Batch events,
+    not_null<Frame_3D*> frame, Scene::Event_Batch events,
     Submitted submitted, Completed completed) {
     implementation_->render(std::move(visuals), parameters, frame,
                             std::move(events), std::move(submitted),
diff --git a/render_3D/render_3D/detail/Async_Render_Backend.hpp b/render_3D/render_3D/detail/Async_Render_Backend.hpp
index 23ce36d..4ab03e4 100644
--- a/render_3D/render_3D/detail/Async_Render_Backend.hpp
+++ b/render_3D/render_3D/detail/Async_Render_Backend.hpp
@@ -2,6 +2,7 @@
 #include "../base/Frame_3D.hpp"
 #include "Backend_Types.hpp"
 #include <scene.hpp>
+#include <ownership.hpp>
 #include <exception>
 #include <functional>
 #include <memory>
@@ -14,8 +15,9 @@ public:
     ~Async_Render_Backend();
     Async_Render_Backend(const Async_Render_Backend&) = delete;
     Async_Render_Backend& operator=(const Async_Render_Backend&) = delete;
-    using Submitted = std::function<void(Frame_3D*, bool)>;
-    using Completed = std::function<void(Frame_3D*, std::exception_ptr)>;
+    using Submitted = std::function<void(not_null<Frame_3D*>, bool)>;
+    using Completed =
+        std::function<void(not_null<Frame_3D*>, std::exception_ptr)>;
     /*
      * 3D 核心线程模型：
      * 1. Scene Taskflow worker 准备不可变业务数据；已录制命令的热路径还可并行
@@ -28,7 +30,7 @@ public:
      */
     void render(
         Shared_Prepared_Visual_Batch visuals, Scene_3D_Parameters parameters,
-        Frame_3D* frame, Scene::Event_Batch events,
+        not_null<Frame_3D*> frame, Scene::Event_Batch events,
         Submitted submitted, Completed completed);
     [[nodiscard]] bool available() const noexcept;
 private:
diff --git a/render_3D/render_3D/detail/Datoviz_Visual_Backend.cpp b/render_3D/render_3D/detail/Datoviz_Visual_Backend.cpp
index d39752f..4ac0fd5 100644
--- a/render_3D/render_3D/detail/Datoviz_Visual_Backend.cpp
+++ b/render_3D/render_3D/detail/Datoviz_Visual_Backend.cpp
@@ -35,8 +35,8 @@ std::uint64_t trace_now_ns() noexcept {
             std::chrono::steady_clock::now().time_since_epoch()).count());
 }
 template <typename Resource, typename Allocate>
-Resource* allocate_wrapper(Allocate allocate, const char* message) {
-    Resource* resource = allocate();
+owner<Resource*> allocate_wrapper(Allocate allocate, const char* message) {
+    owner<Resource*> resource = allocate();
     if (resource == nullptr) throw std::runtime_error(message);
     return resource;
 }
@@ -389,8 +389,8 @@ public:
     ~Datoviz_Render_Context() {
         if (gpu_context_ != nullptr) dvz_gpu_ctx_destroy(gpu_context_);
     }
-    [[nodiscard]] DvzGpuCtx* gpu_context() const noexcept {
-        return gpu_context_;
+    [[nodiscard]] not_null<DvzGpuCtx*> gpu_context() const noexcept {
+        return not_null{gpu_context_};
     }
     [[nodiscard]] std::mutex& api_mutex() noexcept {
         return api_mutex_;
@@ -407,7 +407,7 @@ private:
         gpu_context_ = dvz_gpu_ctx(&configuration);
         if (gpu_context_ == nullptr) throw std::runtime_error("failed to create shared Datoviz GPU context");
     }
-    DvzGpuCtx* gpu_context_{}; /* 共享 GPU Device 与分配器的唯一所有权。 */
+    owner<DvzGpuCtx*> gpu_context_{}; /* 共享 GPU Device 与分配器的唯一所有权。 */
     std::mutex api_mutex_{}; /* 同 GPU Datoviz 对象结构修改的串行化域。 */
     std::mutex queue_mutex_{}; /* VkQueue 及会内部使用主队列的 Datoviz 调用的外部同步域。 */
 };
@@ -444,8 +444,10 @@ public:
         std::vector<std::byte> pixels;
         std::optional<Datoviz_Gpu_Timing> gpu_timing;
     };
-    Frame_Target(DvzGpuCtx* gpu_context, Extent extent, std::uint64_t generation) : gpu_context_(gpu_context), extent_(extent), generation_(generation) {
-        if (gpu_context == nullptr || extent.empty()) throw std::invalid_argument("invalid Datoviz point frame target");
+    Frame_Target(not_null<DvzGpuCtx*> gpu_context, Extent extent,
+                 std::uint64_t generation)
+        : gpu_context_(gpu_context), extent_(extent), generation_(generation) {
+        if (extent.empty()) throw std::invalid_argument("invalid Datoviz point frame target");
         const std::uint64_t byte_size = static_cast<std::uint64_t>(extent.width) *
         extent.height * 4ULL;
         if (byte_size > std::numeric_limits<DvzSize>::max()) throw std::length_error("Datoviz point frame target is too large");
@@ -766,12 +768,11 @@ private:
         commands_ = nullptr;
         view_ = nullptr;
         image_ = nullptr;
-        gpu_context_ = nullptr;
     }
-    void initialize_timestamps(DvzDevice* device, DvzQueue* queue) noexcept {
+    void initialize_timestamps(not_null<DvzDevice*> device,
+                               not_null<DvzQueue*> queue) noexcept {
         timestamps_initialized_ = true;
-        if (device == nullptr || queue == nullptr ||
-            vkGetPhysicalDeviceQueueFamilyProperties == nullptr ||
+        if (vkGetPhysicalDeviceQueueFamilyProperties == nullptr ||
             vkGetPhysicalDeviceProperties == nullptr ||
             vkCreateQueryPool == nullptr ||
             vkCmdResetQueryPool == nullptr ||
@@ -887,16 +888,16 @@ private:
             image_ = nullptr;
         }
     }
-    DvzGpuCtx* gpu_context_{};
+    not_null<DvzGpuCtx*> gpu_context_;
     Extent extent_{};
     std::uint64_t generation_{};
     DvzSize byte_size_{};
-    DvzImages* image_{};
-    DvzImageViews* view_{};
-    DvzCommands* commands_{};
-    DvzFence* fence_{};
-    DvzSubmit* submit_{};
-    DvzBuffer* readback_{};
+    owner<DvzImages*> image_{};
+    owner<DvzImageViews*> view_{};
+    owner<DvzCommands*> commands_{};
+    owner<DvzFence*> fence_{};
+    owner<DvzSubmit*> submit_{};
+    owner<DvzBuffer*> readback_{};
     VkQueryPool query_pool_{VK_NULL_HANDLE};
     VkImageLayout completed_layout_{VK_IMAGE_LAYOUT_UNDEFINED};
     float timestamp_period_ns_{};
@@ -938,9 +939,10 @@ void Datoviz_Visual_Backend::Private::initialize(
         render_context_ = Datoviz_Render_Context::acquire(gpu_index, validation_enabled);
         std::scoped_lock context_lock(render_context_->api_mutex(),
                                       render_context_->queue_mutex());
-        auto* gpu_context = render_context_->gpu_context();
+        const auto gpu_context = render_context_->gpu_context();
         DvzDrp2RuntimeConfig runtime_configuration = dvz_drp2_runtime_vklite_config(
-            dvz_gpu_ctx_device(gpu_context), dvz_gpu_ctx_alloc(gpu_context));
+            dvz_gpu_ctx_device(gpu_context.get()),
+            dvz_gpu_ctx_alloc(gpu_context.get()));
         for (auto& slot : runtime_slots_) {
             slot.runtime = dvz_drp2_runtime_vklite(&runtime_configuration);
             slot.emitter = dvz_frame_plan_emitter();
@@ -966,10 +968,15 @@ void Datoviz_Visual_Backend::Private::create_scene(
     if (scene_ == nullptr) throw std::runtime_error("failed to create Datoviz scene");
     const auto capabilities = offscreen_capabilities();
     if (dvz_scene_set_capabilities(scene_, &capabilities) != DVZ_OK) throw std::runtime_error("failed to configure Datoviz scene capabilities");
-    figure_ = dvz_figure(scene_, initial_scene.viewport.width,
-                         initial_scene.viewport.height, 0);
-    panel_ = figure_ != nullptr ? dvz_panel_full(figure_) : nullptr;
-    if (figure_ == nullptr || panel_ == nullptr) throw std::runtime_error("failed to create Datoviz figure and panel");
+    auto* figure = dvz_figure(scene_, initial_scene.viewport.width,
+                              initial_scene.viewport.height, 0);
+    if (figure == nullptr)
+        throw std::runtime_error("failed to create Datoviz figure");
+    auto* panel = dvz_panel_full(figure);
+    if (panel == nullptr)
+        throw std::runtime_error("failed to create Datoviz panel");
+    figure_ = not_null{figure};
+    panel_ = not_null{panel};
     bool wants_item_interaction{};
     visuals_.reserve(registrations.size());
     for (const auto& registration : registrations) {
@@ -1123,7 +1130,9 @@ void Datoviz_Visual_Backend::Private::create_scene(
                 dvz_volume_set_step_count(visual, 48) != DVZ_OK)
                 throw std::runtime_error("failed to create Datoviz volume field");
         }
-        if (visual == nullptr || dvz_panel_add_visual(panel_, visual, nullptr) != DVZ_OK) throw std::runtime_error("failed to create Datoviz visual family");
+        if (visual == nullptr ||
+            dvz_panel_add_visual(panel, visual, nullptr) != DVZ_OK)
+            throw std::runtime_error("failed to create Datoviz visual family");
         if (supports_item_interaction(family)) {
             if (dvz_visual_set_query_capabilities(
                 visual, DVZ_QUERY_CAPABILITY_ITEM) != DVZ_OK)
@@ -1132,7 +1141,7 @@ void Datoviz_Visual_Backend::Private::create_scene(
         }
         DvzText* coordinate_text{};
         if (family == Visual_Family::marker) {
-            coordinate_text = dvz_text(panel_, 0);
+            coordinate_text = dvz_text(panel, 0);
             DvzTextPlacement placement = dvz_text_placement();
             placement.mode = DVZ_TEXT_PLACEMENT_DATA;
             placement.anchor = DVZ_SCENE_ANCHOR_DATA;
@@ -1145,9 +1154,16 @@ void Datoviz_Visual_Backend::Private::create_scene(
                 dvz_text_set_style(coordinate_text, &style) != DVZ_OK)
                 throw std::runtime_error("failed to create Datoviz marker coordinate labels");
         }
+        std::optional<not_null<DvzSampledField*>> field_borrow{};
+        if (sampled_field != nullptr) field_borrow = not_null{sampled_field};
+        std::optional<not_null<DvzFont*>> font_borrow{};
+        if (font != nullptr) font_borrow = not_null{font};
+        std::optional<not_null<DvzText*>> coordinate_text_borrow{};
+        if (coordinate_text != nullptr)
+            coordinate_text_borrow = not_null{coordinate_text};
         visuals_.push_back(
-            {registration.identity, family, visual, sampled_field, font,
-             coordinate_text,
+            {registration.identity, family, not_null{visual}, field_borrow,
+             font_borrow, coordinate_text_borrow,
              family == Visual_Family::volume
                  ? std::array<std::uint32_t, 3>{16, 16, 16}
                  : family == Visual_Family::labels
@@ -1158,17 +1174,19 @@ void Datoviz_Visual_Backend::Private::create_scene(
              0});
     }
     if (wants_item_interaction) {
-        item_interaction_ = dvz_item_interaction(panel_, nullptr);
+        item_interaction_ = dvz_item_interaction(panel, nullptr);
         if (item_interaction_ == nullptr) throw std::runtime_error("failed to create Datoviz item interaction");
     }
-    axes_visual_ = dvz_segment(scene_, 0);
-    axes_text_ = dvz_text(panel_, 0);
-    if (axes_visual_ == nullptr || axes_text_ == nullptr ||
-        dvz_segment_set_caps(axes_visual_, DVZ_SEGMENT_CAP_BUTT,
+    auto* axes_visual = dvz_segment(scene_, 0);
+    auto* axes_text = dvz_text(panel, 0);
+    if (axes_visual == nullptr || axes_text == nullptr ||
+        dvz_segment_set_caps(axes_visual, DVZ_SEGMENT_CAP_BUTT,
                              DVZ_SEGMENT_CAP_BUTT) != DVZ_OK ||
-        dvz_visual_set_alpha_mode(axes_visual_, DVZ_ALPHA_OPAQUE) != DVZ_OK ||
-        dvz_panel_add_visual(panel_, axes_visual_, nullptr) != DVZ_OK)
+        dvz_visual_set_alpha_mode(axes_visual, DVZ_ALPHA_OPAQUE) != DVZ_OK ||
+        dvz_panel_add_visual(panel, axes_visual, nullptr) != DVZ_OK)
         throw std::runtime_error("failed to create Datoviz 3D axes visuals");
+    axes_visual_ = not_null{axes_visual};
+    axes_text_ = not_null{axes_text};
     DvzTextPlacement axes_placement = dvz_text_placement();
     axes_placement.mode = DVZ_TEXT_PLACEMENT_DATA;
     axes_placement.anchor = DVZ_SCENE_ANCHOR_DATA;
@@ -1176,8 +1194,8 @@ void Datoviz_Visual_Backend::Private::create_scene(
     DvzTextStyle axes_style = dvz_text_style();
     axes_style.renderer = DVZ_TEXT_RENDERER_MSDF_ATLAS;
     axes_style.size_px = 12.0F;
-    if (dvz_text_set_placement(axes_text_, &axes_placement) != DVZ_OK ||
-        dvz_text_set_style(axes_text_, &axes_style) != DVZ_OK)
+    if (dvz_text_set_placement(axes_text, &axes_placement) != DVZ_OK ||
+        dvz_text_set_style(axes_text, &axes_style) != DVZ_OK)
         throw std::runtime_error("failed to configure Datoviz 3D axes text");
     apply_axes(initial_scene);
     input_router_ = dvz_input_router();
@@ -1185,7 +1203,7 @@ void Datoviz_Visual_Backend::Private::create_scene(
                            ? dvz_pointer_gesture_handler(input_router_)
                            : nullptr;
     if (input_router_ == nullptr || gesture_handler_ == nullptr ||
-        dvz_panel_connect_input(panel_, input_router_) != DVZ_OK)
+        dvz_panel_connect_input(panel, input_router_) != DVZ_OK)
         throw std::runtime_error("failed to connect Datoviz point input");
     apply_camera(initial_scene.camera);
     DvzInputResizeEvent resize{
@@ -1294,13 +1312,13 @@ void Datoviz_Visual_Backend::Private::apply_axes(
             {"stroke_width_px", widths.data(), segment_count}
         }
     };
-    if (dvz_visual_set_data_many(axes_visual_, updates.data(),
+    if (dvz_visual_set_data_many(axes_visual_->get(), updates.data(),
                                  static_cast<std::uint32_t>(updates.size())) != DVZ_OK ||
-        dvz_visual_set_visible(axes_visual_, !starts.empty()) != DVZ_OK)
+        dvz_visual_set_visible(axes_visual_->get(), !starts.empty()) != DVZ_OK)
         throw std::runtime_error("failed to upload Datoviz 3D axes geometry");
     for (std::size_t index = 0; index < text_items.size(); ++index) text_items[index].string = strings[index].c_str();
     if (dvz_text_set_items(
-        axes_text_, text_items.empty() ? nullptr : text_items.data(),
+        axes_text_->get(), text_items.empty() ? nullptr : text_items.data(),
         static_cast<std::uint32_t>(text_items.size())) != DVZ_OK)
         throw std::runtime_error("failed to upload Datoviz 3D axes labels");
     applied_axes_ = descriptors;
@@ -1335,7 +1353,7 @@ void Datoviz_Visual_Backend::Private::apply_camera(
     camera.projection.ortho_height = static_cast<float>(
         2.0 * distance *
         std::tan(source.vertical_field_of_view_degrees * std::numbers::pi / 360.0));
-    if (dvz_panel_set_camera_desc(panel_, &camera) != DVZ_OK) throw std::runtime_error("failed to apply Datoviz Camera component");
+    if (dvz_panel_set_camera_desc(panel_->get(), &camera) != DVZ_OK) throw std::runtime_error("failed to apply Datoviz Camera component");
     DvzDimMask dimensions = DVZ_DIM_MASK_XYZ;
     switch (source.controller) {
     case Camera_Controller::turntable: {
@@ -1399,7 +1417,7 @@ void Datoviz_Visual_Backend::Private::apply_camera(
     }
     }
     if (camera_controller_ == nullptr ||
-        dvz_panel_bind_controller(panel_, camera_controller_, dimensions) != DVZ_OK)
+        dvz_panel_bind_controller(panel_->get(), camera_controller_, dimensions) != DVZ_OK)
         throw std::runtime_error("failed to bind Datoviz camera controller");
     applied_camera_ = source;
 }
@@ -1431,7 +1449,7 @@ std::uint64_t Datoviz_Visual_Backend::Private::apply(
     const Scene_3D_Parameters& scene, const Prepared_Visual_Batch& prepared,
     std::uint8_t target_index, bool bind_target) {
     if (figure_extent_ != scene.viewport) {
-        if (dvz_figure_resize(figure_, scene.viewport.width,
+        if (dvz_figure_resize(figure_->get(), scene.viewport.width,
                               scene.viewport.height) != DVZ_OK)
             throw std::runtime_error("failed to resize Datoviz point figure");
         DvzInputResizeEvent resize{
@@ -1506,8 +1524,9 @@ void Datoviz_Visual_Backend::Private::ensure_external_attributes(
         auto* gpu_buffer = allocate_wrapper<DvzBuffer>(
             dvz_buffer_create_wrapper,
             "failed to allocate Datoviz external GPU buffer wrapper");
-        auto* gpu_context = render_context_->gpu_context();
-        dvz_buffer(dvz_gpu_ctx_device(gpu_context), dvz_gpu_ctx_alloc(gpu_context),
+        const auto gpu_context = render_context_->gpu_context();
+        dvz_buffer(dvz_gpu_ctx_device(gpu_context.get()),
+                   dvz_gpu_ctx_alloc(gpu_context.get()),
                    gpu_buffer);
         dvz_buffer_size(gpu_buffer, static_cast<DvzSize>(byte_size));
         dvz_buffer_usage(gpu_buffer, VK_BUFFER_USAGE_VERTEX_BUFFER_BIT);
@@ -1519,7 +1538,7 @@ void Datoviz_Visual_Backend::Private::ensure_external_attributes(
         external_buffers_.push_back(gpu_buffer);
         attributes.push_back({
             name, stride, static_cast<std::uint32_t>(capacity),
-            scene_buffer, gpu_buffer, false
+            not_null{scene_buffer}, gpu_buffer, false
         });
     };
     switch (target.family) {
@@ -1669,8 +1688,8 @@ void Datoviz_Visual_Backend::Private::bind_external_attributes(
     for (auto& attribute : target.attributes) {
         const std::uint64_t byte_offset = static_cast<std::uint64_t>(target_index) *
         attribute.capacity * attribute.stride;
-        if (dvz_visual_set_attr_buffer(target.visual, attribute.name.c_str(),
-                                       attribute.scene_buffer, byte_offset,
+        if (dvz_visual_set_attr_buffer(target.visual.get(), attribute.name.c_str(),
+                                       attribute.scene_buffer.get(), byte_offset,
                                        item_count) != DVZ_OK)
             throw std::runtime_error("failed to bind Datoviz external visual attribute");
     }
@@ -1684,13 +1703,13 @@ void Datoviz_Visual_Backend::Private::register_external_attributes(
         for (auto& attribute : visual.attributes) {
             if ((attribute.registered_targets & target_bit) != 0) continue;
             char key[DVZ_SCENE_LABEL_SIZE]{};
-            if (!dvz_scene_buffer_resource_key(attribute.scene_buffer, key,
+            if (!dvz_scene_buffer_resource_key(attribute.scene_buffer.get(), key,
                                                sizeof(key)))
                 throw std::runtime_error("failed to resolve Datoviz external buffer key");
             const auto id = dvz_drp2_stream_label_id(stream, key);
             if (id == 0) throw std::runtime_error("Datoviz frame omitted an external buffer label");
             DvzSceneBufferDesc scene_descriptor{};
-            if (!dvz_scene_buffer_info(attribute.scene_buffer,
+            if (!dvz_scene_buffer_info(attribute.scene_buffer.get(),
                                        &scene_descriptor))
                 throw std::runtime_error("failed to inspect Datoviz external buffer");
             auto descriptor = dvz_drp2_external_buffer_desc();
@@ -1713,10 +1732,10 @@ std::uint64_t Datoviz_Visual_Backend::Private::apply_visual(
         point.revision == target.applied_revision)
         return 0;
     const auto item_count = prepared_item_count(point);
-    auto* visual = target.visual;
+    auto* visual = target.visual.get();
     const bool structure_changed = !target.applied ||
     !same_visual_structure(*target.applied, point);
-    const bool coordinate_text_changed = target.coordinate_text != nullptr &&
+    const bool coordinate_text_changed = target.coordinate_text.has_value() &&
     (!target.applied || has_coordinate_labels(*target.applied) ||
         has_coordinate_labels(point));
     if (coordinate_text_changed) {
@@ -1754,7 +1773,7 @@ std::uint64_t Datoviz_Visual_Backend::Private::apply_visual(
             }
         }
         for (std::size_t index = 0; index < items.size(); ++index) items[index].string = strings[index].c_str();
-        if (dvz_text_set_items(target.coordinate_text,
+        if (dvz_text_set_items(target.coordinate_text->get(),
                                items.empty() ? nullptr : items.data(),
                                static_cast<std::uint32_t>(items.size())) != DVZ_OK)
             throw std::runtime_error("failed to upload Datoviz marker coordinate labels");
@@ -1946,7 +1965,7 @@ std::uint64_t Datoviz_Visual_Backend::Private::apply_visual(
     }
     case Visual_Family::image: {
         const auto& data = prepared_data<Image_Prepared_Data>(point);
-        if (target.field == nullptr)
+        if (!target.field)
             throw std::logic_error("Datoviz image has no sampled field");
         auto view = dvz_field_data_view();
         view.data = data.field_pixels.data();
@@ -1955,9 +1974,9 @@ std::uint64_t Datoviz_Visual_Backend::Private::apply_visual(
         view.rows_per_image = data.field_height;
         const std::array extent{data.field_width, data.field_height, 1U};
         result = extent == target.field_extent
-            ? dvz_sampled_field_set_data(target.field, &view)
+            ? dvz_sampled_field_set_data(target.field->get(), &view)
             : dvz_sampled_field_resize(
-                target.field, extent[0], extent[1], extent[2], &view);
+                target.field->get(), extent[0], extent[1], extent[2], &view);
         if (result != DVZ_OK) break;
         target.field_extent = extent;
         const std::array<DvzVisualDataUpdate, 3> updates{
@@ -1972,7 +1991,7 @@ std::uint64_t Datoviz_Visual_Backend::Private::apply_visual(
     }
     case Visual_Family::labels: {
         const auto& data = prepared_data<Labels_Prepared_Data>(point);
-        if (target.field == nullptr)
+        if (!target.field)
             throw std::logic_error("Datoviz labels visual has no sampled field");
         auto view = dvz_field_data_view();
         view.data = data.field_labels.data();
@@ -1981,9 +2000,9 @@ std::uint64_t Datoviz_Visual_Backend::Private::apply_visual(
         view.rows_per_image = data.field_height;
         const std::array extent{data.field_width, data.field_height, 1U};
         result = extent == target.field_extent
-            ? dvz_sampled_field_set_data(target.field, &view)
+            ? dvz_sampled_field_set_data(target.field->get(), &view)
             : dvz_sampled_field_resize(
-                target.field, extent[0], extent[1], extent[2], &view);
+                target.field->get(), extent[0], extent[1], extent[2], &view);
         if (result != DVZ_OK) break;
         target.field_extent = extent;
         const std::array<DvzVisualDataUpdate, 3> updates{
@@ -2010,7 +2029,9 @@ std::uint64_t Datoviz_Visual_Backend::Private::apply_visual(
         break;
     }
     case Visual_Family::text: {
-        upload_text(visual, target.font,
+        if (!target.font)
+            throw std::logic_error("Datoviz text visual has no font");
+        upload_text(visual, target.font->get(),
                     prepared_data<Text_Prepared_Data>(point));
         break;
     }
@@ -2025,7 +2046,7 @@ std::uint64_t Datoviz_Visual_Backend::Private::apply_visual(
         if (expected != data.values.size())
             throw std::invalid_argument(
                 "3D volume voxel count does not match field dimensions");
-        if (target.field == nullptr)
+        if (!target.field)
             throw std::logic_error("Datoviz volume has no sampled field");
         auto view = dvz_field_data_view();
         view.data = data.values.data();
@@ -2035,9 +2056,9 @@ std::uint64_t Datoviz_Visual_Backend::Private::apply_visual(
         const std::array extent{
             data.field_width, data.field_height, data.field_depth};
         result = extent == target.field_extent
-            ? dvz_sampled_field_set_data(target.field, &view)
+            ? dvz_sampled_field_set_data(target.field->get(), &view)
             : dvz_sampled_field_resize(
-                target.field, extent[0], extent[1], extent[2], &view);
+                target.field->get(), extent[0], extent[1], extent[2], &view);
         if (result == DVZ_OK) target.field_extent = extent;
         break;
     }
@@ -2148,7 +2169,7 @@ DvzSceneFrameArtifact* Datoviz_Visual_Backend::Private::emit(
      * N-1's resource state. Replaying retained payloads also compensates for the
      * Scene-wide dirty flags committed by another target's preceding emission. */
     auto* artifact = dvz_figure_emit_frame_with_emitter(
-        figure_, runtime_slots_[target_index].emitter, true,
+        figure_->get(), runtime_slots_[target_index].emitter, true,
         &capabilities, &report, &configuration);
     if (artifact == nullptr) {
         std::string message = "failed to emit Datoviz visual frame";
@@ -2282,7 +2303,7 @@ Datoviz_Visual_Backend::Private::prepare(
         scene, visuals, *target_index, bind_target);
     if (item_interaction_ != nullptr) {
         static_cast<void>(dvz_figure_process_queries(
-            figure_, runtime_slots_[*target_index].runtime, nullptr));
+            figure_->get(), runtime_slots_[*target_index].runtime, nullptr));
         DvzQueryResult query{};
         bool resolved{};
         while (dvz_scene_poll_query(scene_, &query)) resolved = true;
@@ -2309,7 +2330,7 @@ Datoviz_Visual_Backend::Private::prepare(
                         std::ranges::copy(item_label, query.label);
                     }
                 }
-                hover_readout_ = dvz_pinned_readout_query(panel_, &query);
+                hover_readout_ = dvz_pinned_readout_query(panel_->get(), &query);
             }
         }
     }
@@ -2499,7 +2520,8 @@ void Datoviz_Visual_Backend::Private::destroy() {
             dvz_pinned_readout_destroy(hover_readout_);
             hover_readout_ = nullptr;
         }
-        if (panel_ != nullptr && input_router_ != nullptr) (void)dvz_panel_connect_input(panel_, nullptr);
+        if (panel_ && input_router_ != nullptr)
+            (void)dvz_panel_connect_input(panel_->get(), nullptr);
         if (gesture_handler_ != nullptr) {
             dvz_pointer_gesture_handler_destroy(gesture_handler_);
             gesture_handler_ = nullptr;
@@ -2509,12 +2531,12 @@ void Datoviz_Visual_Backend::Private::destroy() {
             input_router_ = nullptr;
         }
         visuals_.clear();
-        axes_visual_ = nullptr;
-        axes_text_ = nullptr;
+        axes_visual_.reset();
+        axes_text_.reset();
         applied_camera_.reset();
         applied_axes_.reset();
-        panel_ = nullptr;
-        figure_ = nullptr;
+        panel_.reset();
+        figure_.reset();
         if (scene_ != nullptr) {
             dvz_scene_destroy(scene_);
             scene_ = nullptr;
diff --git a/render_3D/render_3D/detail/Datoviz_Visual_Backend.hpp b/render_3D/render_3D/detail/Datoviz_Visual_Backend.hpp
index cc89bb2..67281f8 100644
--- a/render_3D/render_3D/detail/Datoviz_Visual_Backend.hpp
+++ b/render_3D/render_3D/detail/Datoviz_Visual_Backend.hpp
@@ -3,6 +3,7 @@
 #include "../base/Datoviz_Frame_Observation.hpp"
 #include "Backend_Types.hpp"
 #include <render_common.hpp>
+#include <ownership.hpp>
 #include <volk.h>
 #include <cstddef>
 #include <cstdint>
diff --git a/render_3D/render_3D/detail/Datoviz_Visual_Backend.ipp b/render_3D/render_3D/detail/Datoviz_Visual_Backend.ipp
index c31e150..3361a21 100644
--- a/render_3D/render_3D/detail/Datoviz_Visual_Backend.ipp
+++ b/render_3D/render_3D/detail/Datoviz_Visual_Backend.ipp
@@ -23,18 +23,18 @@ struct Datoviz_Visual_Backend::Private : Prev_Private {
         std::string name{};                     /* Datoviz attribute semantic owned by this binding. */
         std::uint32_t stride{};                 /* One planar attribute item in bytes. */
         std::uint32_t capacity{};               /* Items per independently writable frame region. */
-        DvzSceneBuffer* scene_buffer{};         /* Scene-side stable resource label; Scene owns it. */
-        DvzBuffer* gpu_buffer{};                /* Three-region runtime buffer owned by this backend. */
+        not_null<DvzSceneBuffer*> scene_buffer; /* Scene-side stable resource label; Scene owns it. */
+        owner<DvzBuffer*> gpu_buffer{};         /* Three-region runtime buffer owned by this backend. */
         std::uint8_t registered_targets{};      /* Runtime slots that have borrowed gpu_buffer. */
     };
 
     struct Visual_Instance {
         Visual_Identity identity{};                         /* Scene 注册的稳定身份。 */
         Visual_Family family{Visual_Family::point};         /* 原生 Visual 的确定 family。 */
-        DvzVisual* visual{};                                /* 由 Datoviz Scene 拥有。 */
-        DvzSampledField* field{};                           /* 仅纹理和体数据 family 使用的 Scene 字段资源。 */
-        DvzFont* font{};                                    /* Glyph/Text 使用的 Scene 字体与可增长 atlas 来源。 */
-        DvzText* coordinate_text{};                         /* Marker 的数据坐标 XYZ 标注。 */
+        not_null<DvzVisual*> visual;                        /* 由 Datoviz Scene 拥有。 */
+        std::optional<not_null<DvzSampledField*>> field{};  /* 仅纹理和体数据 family 使用的 Scene 字段资源。 */
+        std::optional<not_null<DvzFont*>> font{};           /* Glyph/Text 使用的 Scene 字体与可增长 atlas 来源。 */
+        std::optional<not_null<DvzText*>> coordinate_text{}; /* Marker 的数据坐标 XYZ 标注。 */
         std::array<std::uint32_t, 3> field_extent{};        /* field 当前样本尺寸。 */
         std::uint64_t applied_revision{};                   /* 此 Visual 已上传的 Prepare 版本。 */
         std::array<std::uint64_t, 3> uploaded_data_revisions{}; /* 各物理帧区已写入的数据版本。 */
@@ -43,8 +43,8 @@ struct Datoviz_Visual_Backend::Private : Prev_Private {
     };
 
     struct Runtime_Slot {
-        DvzDrp2Runtime* runtime{};           /* 只执行对应帧目标的命令流。 */
-        DvzFramePlanEmitter* emitter{};      /* 与 runtime 一一对应的保留语义状态。 */
+        owner<DvzDrp2Runtime*> runtime{};    /* 后端拥有的目标槽命令运行时。 */
+        owner<DvzFramePlanEmitter*> emitter{}; /* 后端拥有、与 runtime 一一对应的发射器。 */
     };
 
     Private();
@@ -113,18 +113,18 @@ struct Datoviz_Visual_Backend::Private : Prev_Private {
     std::shared_ptr<Datoviz_Render_Context> render_context_{}; /* 同一 GPU 上所有后端共享的 Device 与分配器。 */
     mutable std::mutex target_mutex_{};                       /* 当前 Scene 三个目标槽的唯一生命周期同步源。 */
     std::array<Runtime_Slot, 3> runtime_slots_{};             /* 三套独立 runtime/emitter 状态机。 */
-    DvzScene* scene_{};                                       /* 本后端唯一拥有的 Datoviz Scene。 */
-    DvzFigure* figure_{};                                     /* 当前离屏 Figure。 */
-    DvzPanel* panel_{};                                       /* 承载全部业务 Visual 的全屏 Panel。 */
+    owner<DvzScene*> scene_{};                                /* 本后端唯一拥有的 Datoviz Scene。 */
+    std::optional<not_null<DvzFigure*>> figure_{};             /* 当前离屏 Figure。 */
+    std::optional<not_null<DvzPanel*>> panel_{};               /* 承载全部业务 Visual 的全屏 Panel。 */
     std::vector<Visual_Instance> visuals_{};                   /* 按 Scene 稳定身份管理的原生 Visual。 */
-    std::vector<DvzBuffer*> external_buffers_{};               /* runtime 销毁前保持存活的借用缓冲。 */
-    DvzVisual* axes_visual_{};                                /* 三维主轴、刻度和网格 Segment Visual。 */
-    DvzText* axes_text_{};                                    /* 随相机变换的三维刻度与轴标题。 */
-    DvzItemInteraction* item_interaction_{};                  /* Datoviz 原生图元悬停与选择控制器。 */
-    DvzPinnedReadout* hover_readout_{};                       /* 最近一次命中的 Datoviz 数据提示卡。 */
-    DvzController* camera_controller_{};                      /* 当前绑定到 Panel 的原生相机控制器。 */
-    DvzInputRouter* input_router_{};                          /* Scene 输入事件路由器。 */
-    DvzPointerGestureHandler* gesture_handler_{};             /* 指针手势解析器。 */
+    std::vector<owner<DvzBuffer*>> external_buffers_{};       /* 后端拥有；runtime 销毁后释放。 */
+    std::optional<not_null<DvzVisual*>> axes_visual_{};        /* 三维主轴、刻度和网格 Segment Visual。 */
+    std::optional<not_null<DvzText*>> axes_text_{};            /* 随相机变换的三维刻度与轴标题。 */
+    owner<DvzItemInteraction*> item_interaction_{};           /* 后端显式销毁的图元交互器。 */
+    owner<DvzPinnedReadout*> hover_readout_{};                /* 后端显式销毁的悬停提示。 */
+    owner<DvzController*> camera_controller_{};               /* 后端显式销毁的相机控制器。 */
+    owner<DvzInputRouter*> input_router_{};                   /* 后端显式销毁的输入路由器。 */
+    owner<DvzPointerGestureHandler*> gesture_handler_{};      /* 后端显式销毁的手势处理器。 */
     std::unique_ptr<Frame_Targets> targets_{};                 /* 三个可并行处于准备、GPU、读回阶段的目标。 */
     Extent figure_extent_{};                                  /* Figure 当前应用的像素尺寸。 */
     std::uint64_t target_generation_{};                       /* 每次重建目标时递增的资源代次。 */
diff --git a/render_3D/render_3D/detail/Gpu_Completion_Service.cpp b/render_3D/render_3D/detail/Gpu_Completion_Service.cpp
index ae6cc91..46606c8 100644
--- a/render_3D/render_3D/detail/Gpu_Completion_Service.cpp
+++ b/render_3D/render_3D/detail/Gpu_Completion_Service.cpp
@@ -33,7 +33,7 @@ Gpu_Completion_Service& Gpu_Completion_Service::instance() {
      * 为等待 Frame_Scheduler callback 退出而引入同步取消；进程终止负责
      * 回收其内存，Scheduler 仍按自身 RAII 顺序停止控制线程。
      */
-    static auto* service = [] {
+    static owner<Gpu_Completion_Service*> service = [] {
         auto built = Gpu_Completion_Service::Builder<Gpu_Completion_Service>{}.build();
         if (!built)
             throw std::logic_error(
@@ -67,13 +67,13 @@ void Gpu_Completion_Service::Reservation::watch(VkDevice device,
     if (!pending_ || device == VK_NULL_HANDLE || fence == VK_NULL_HANDLE)
         throw std::logic_error(
             "GPU completion reservation or fence is invalid");
-    pending_->service->watch(pending_, device, fence);
+    (*pending_->service)->watch(pending_, device, fence);
     pending_.reset();
 }
 
 void Gpu_Completion_Service::Reservation::cancel() {
     if (!pending_) return;
-    pending_->service->cancel(pending_);
+    (*pending_->service)->cancel(pending_);
     pending_.reset();
 }
 
@@ -113,12 +113,12 @@ Gpu_Completion_Service::Private::prepare(
     pending->completion = std::move(completion);
     pending->on_exception = std::move(on_exception);
     pending->observe = observe;
-    pending->service = object;
+    pending->service = *object;
     Admission_Result admission{Admission_Result::none};
     double_buffer::detail::Internal_Access::update_state<
         &State::in_flight, &State::peak_in_flight,
         &State::reservation_count, &State::backpressure_count>(
-        object,
+        object->get(),
         [&](State_Access<State> states) {
             auto& state = states.template get<Base_Tag>();
             if (state.in_flight >= state.capacity) {
@@ -133,10 +133,10 @@ Gpu_Completion_Service::Private::prepare(
     if (admission != Admission_Result::none)
         return {{}, admission};
     try {
-        double_buffer::detail::Internal_Access::submit_stream<GPU_Task_Tag>(object, pending);
+        double_buffer::detail::Internal_Access::submit_stream<GPU_Task_Tag>(object->get(), pending);
     }
     catch (...) {
-        double_buffer::detail::Internal_Access::update_state<&State::in_flight>(object,
+        double_buffer::detail::Internal_Access::update_state<&State::in_flight>(object->get(),
             [](State_Access<State> states) {
                 auto& state = states.template get<Base_Tag>();
                 if (state.in_flight != 0) --state.in_flight;
@@ -161,7 +161,7 @@ void Gpu_Completion_Service::Private::watch(
         pending->watched_at = std::chrono::steady_clock::now();
         pending->status = Gpu_Completion_Pending_Fence::Status::watched;
     }
-    double_buffer::detail::Internal_Access::update_state<&State::watched, &State::peak_watched>(object,
+    double_buffer::detail::Internal_Access::update_state<&State::watched, &State::peak_watched>(object->get(),
         [](State_Access<State> states) {
             auto& state = states.template get<Base_Tag>();
             ++state.watched;
@@ -183,7 +183,7 @@ void Gpu_Completion_Service::Private::cancel(
 
 Gpu_Completion_State Gpu_Completion_Service::Private::state() const {
     Gpu_Completion_State result{};
-    double_buffer::detail::Internal_Access::access_state<Base_Tag>(object,
+    double_buffer::detail::Internal_Access::access_state<Base_Tag>(object->get(),
         [&](const State& state) {
             result.capacity = state.capacity;
             result.in_flight = state.in_flight;
@@ -220,8 +220,8 @@ void Gpu_Completion_Service::Private::request_poll(
 void Gpu_Completion_Service::Private::poll() noexcept {
     if (stopping.load(std::memory_order_acquire)) return;
     try {
-        double_buffer::detail::Internal_Access::exchange_stream<GPU_Task_Tag>(object);
-        double_buffer::detail::Internal_Access::access_rendering_stream<GPU_Task_Tag>(object,
+        double_buffer::detail::Internal_Access::exchange_stream<GPU_Task_Tag>(object->get());
+        double_buffer::detail::Internal_Access::access_rendering_stream<GPU_Task_Tag>(object->get(),
             [&](std::span<std::shared_ptr<Gpu_Completion_Pending_Fence>> pending) {
                 active.insert(active.end(), pending.begin(), pending.end());
             });
@@ -246,7 +246,7 @@ void Gpu_Completion_Service::Private::poll() noexcept {
             }
             double_buffer::detail::Internal_Access::update_state<
                 &State::watched, &State::fault_count, &State::abandoned_count>(
-                object,
+                object->get(),
                 [error](State_Access<State> states) {
                     auto& state = states.template get<Base_Tag>();
                     if (state.watched != 0) --state.watched;
@@ -266,7 +266,7 @@ void Gpu_Completion_Service::Private::poll() noexcept {
                 &State::callback_total_ns, &State::callback_max_ns,
                 &State::callback_failure_count, &State::completion_count,
                 &State::in_flight>(
-                object,
+                object->get(),
                 [callback_ns, &callback_failure](State_Access<State> states) {
                     auto& state = states.template get<Base_Tag>();
                     state.callback_total_ns += callback_ns;
@@ -301,7 +301,7 @@ void Gpu_Completion_Service::Private::poll() noexcept {
                 iterator = active.erase(iterator);
                 double_buffer::detail::Internal_Access::update_state<
                     &State::cancellation_count, &State::in_flight>(
-                    object,
+                    object->get(),
                     [](State_Access<State> states) {
                         auto& state = states.template get<Base_Tag>();
                         ++state.cancellation_count;
@@ -320,7 +320,7 @@ void Gpu_Completion_Service::Private::poll() noexcept {
                 finish(pending, VK_TIMEOUT, Completion_Error::fence_abandoned);
                 continue;
             }
-            double_buffer::detail::Internal_Access::update_state<&State::fence_probe_count>(object,
+            double_buffer::detail::Internal_Access::update_state<&State::fence_probe_count>(object->get(),
                 [](State_Access<State> states) {
                     ++states.template get<Base_Tag>().fence_probe_count;
                 });
@@ -342,14 +342,14 @@ void Gpu_Completion_Service::Private::poll() noexcept {
             now - last_state_publication >= state_publication_interval) {
             double_buffer::detail::Internal_Access::update_state<
                 &State::active_fences, &State::pending_fences>(
-                object,
+                object->get(),
                 [active_count = active.size(), reserved_count](
                     State_Access<State> states) {
                     auto& state = states.template get<Base_Tag>();
                     state.active_fences = active_count;
                     state.pending_fences = reserved_count;
                 });
-            double_buffer::detail::Internal_Access::publish_state<Base_Tag>(object);
+            double_buffer::detail::Internal_Access::publish_state<Base_Tag>(object->get());
             last_state_publication = now;
         }
 
diff --git a/render_3D/render_3D/detail/Gpu_Completion_Service.ipp b/render_3D/render_3D/detail/Gpu_Completion_Service.ipp
index 63cad26..66150c2 100644
--- a/render_3D/render_3D/detail/Gpu_Completion_Service.ipp
+++ b/render_3D/render_3D/detail/Gpu_Completion_Service.ipp
@@ -1,5 +1,6 @@
 #pragma once
 #include <Frame_Policy/Frame_Scheduler.hpp>
+#include <ownership.hpp>
 #include <atomic>
 #include <chrono>
 #include <mutex>
@@ -16,13 +17,13 @@ struct Gpu_Completion_Pending_Fence {
     Gpu_Completion_Service::Completion completion{}; /* 完成或隔离后的交付回调。 */
     Gpu_Completion_Service::Exception_Handler on_exception{}; /* 回调异常的隔离入口。 */
     std::chrono::steady_clock::time_point watched_at{}; /* 开始监视的单调时钟时刻。 */
-    Gpu_Completion_Service* service{}; /* 不拥有的服务实例。 */
+    std::optional<not_null<Gpu_Completion_Service*>> service{}; /* 不拥有的服务实例。 */
     Status status{Status::reserved}; /* service_mutex 下的 reservation 状态。 */
     bool observe{}; /* 是否采集 fence 等待耗时。 */
 };
 struct Gpu_Completion_Service::Private : Prev_Private {
     using Object = Gpu_Completion_Service;
-    Object* object{}; /* Def 机制所属最终对象；生命周期与本 Private 相同。 */
+    std::optional<not_null<Object*>> object{}; /* Def 机制所属最终对象；bind 后有效。 */
     std::mutex service_mutex{}; /* 保护 reservation 状态；fence probe 只在全局 Scheduler 控制线程执行。 */
     std::atomic_bool stopping{}; /* Private 析构开始后拒绝新准入。 */
     std::vector<std::shared_ptr<Gpu_Completion_Pending_Fence>> active{}; /* 仅 Frame_Scheduler 控制线程访问。 */
@@ -33,10 +34,10 @@ struct Gpu_Completion_Service::Private : Prev_Private {
     template <Attached Attached_Object>
     void bind_private_crtp(Attached_Object* attached) {
         Prev_Private::bind_private_crtp(attached);
-        object = static_cast<Object*>(attached);
-        double_buffer::detail::Internal_Access::update_state<&State::capacity>(object,
+        object = not_null{static_cast<Object*>(attached)};
+        double_buffer::detail::Internal_Access::update_state<&State::capacity>(object->get(),
             static_cast<std::size_t>(default_capacity));
-        double_buffer::detail::Internal_Access::publish_state<Base_Tag>(object);
+        double_buffer::detail::Internal_Access::publish_state<Base_Tag>(object->get());
         active.reserve(static_cast<std::size_t>(default_capacity));
         poll_timer = Frame_Scheduler::instance().make_timer(
             [this](Frame_Scheduler::Tick) { poll(); });
diff --git a/render_3D/render_3D/detail/Render_Domain.cpp b/render_3D/render_3D/detail/Render_Domain.cpp
index b99fc20..eb173b6 100644
--- a/render_3D/render_3D/detail/Render_Domain.cpp
+++ b/render_3D/render_3D/detail/Render_Domain.cpp
@@ -36,7 +36,7 @@ Render_Domain::~Render_Domain() {
     request_stop();
     if (thread_.joinable()) thread_.detach();
 }
-void Render_Domain::destroy(Render_Domain* domain) noexcept {
+void Render_Domain::destroy(owner<Render_Domain*> domain) noexcept {
     if (!domain) return;
     /*
      * 最后一个外部引用只关闭准入，不等待线程。run() 会消费完停止边界前已经
@@ -72,7 +72,7 @@ Render_Domain::Post_Result Render_Domain::post(
     return Post_Result::queued;
 }
 void Render_Domain::run() noexcept {
-    current_domain_ = this;
+    current_domain_ = not_null{this};
     for (;;) {
         std::unique_ptr<Task> task;
         bool received = tasks_.wait_dequeue_timed(
@@ -102,7 +102,7 @@ void Render_Domain::run() noexcept {
         // 不能参与线程退出正确性。
         if (!received && stopping_.load(std::memory_order_acquire) &&
             active_posters_.load(std::memory_order_acquire) == 0) {
-            current_domain_ = nullptr;
+            current_domain_.reset();
             if (destroy_on_exit_.load(std::memory_order_acquire)) {
                 if (thread_.joinable()) thread_.detach();
                 delete this;
diff --git a/render_3D/render_3D/detail/Render_Domain.hpp b/render_3D/render_3D/detail/Render_Domain.hpp
index de764ad..7326bdf 100644
--- a/render_3D/render_3D/detail/Render_Domain.hpp
+++ b/render_3D/render_3D/detail/Render_Domain.hpp
@@ -1,11 +1,13 @@
 #pragma once
 #include "Exception.hpp"
+#include <ownership.hpp>
 #include <concurrentqueue-1.0.5/blockingconcurrentqueue.h>
 #include <atomic>
 #include <cstddef>
 #include <cstdint>
 #include <functional>
 #include <memory>
+#include <optional>
 #include <thread>
 #include <utility>
 namespace aethera::render_3d::detail {
@@ -28,11 +30,12 @@ public:
                                    Exception_Handler on_exception);
 private:
     Render_Domain();
-    static void destroy(Render_Domain* domain) noexcept;
+    static void destroy(owner<Render_Domain*> domain) noexcept;
     void request_stop() noexcept;
     void run() noexcept;
     static constexpr std::size_t initial_capacity = 64;
-    inline static thread_local Render_Domain* current_domain_{}; /* 当前线程正在执行的 GPU 域。 */
+    inline static thread_local std::optional<not_null<Render_Domain*>>
+        current_domain_{}; /* 当前线程正在执行的 GPU 域。 */
     moodycamel::BlockingConcurrentQueue<std::unique_ptr<Task>> tasks_{initial_capacity}; /* 多生产者闭包入口与唯一消费队列。 */
     std::atomic_size_t active_posters_{}; /* 停止准入边界内仍可能完成入队的生产者数量。 */
     std::atomic_bool stopping_{}; /* 拒绝新闭包并准备退出。 */
diff --git a/render_3D/render_3D/scene/Render_Scene_3D.cpp b/render_3D/render_3D/scene/Render_Scene_3D.cpp
index 5980023..f3c8d56 100644
--- a/render_3D/render_3D/scene/Render_Scene_3D.cpp
+++ b/render_3D/render_3D/scene/Render_Scene_3D.cpp
@@ -2,7 +2,8 @@
 namespace aethera::render_3d {
 bool Render_Scene_3D::Prop::operator==(const Prop&) const = default;
 
-Render_Scene_3D::Render_Result Render_Scene_3D::render(Frame_3D* frame) {
+Render_Scene_3D::Render_Result Render_Scene_3D::render(
+    not_null<Frame_3D*> frame) {
     return double_buffer::detail::Internal_Access::get(this).render(this, frame);
 }
 void Render_Scene_3D::set_frame_callback(Frame_Callback callback) {
diff --git a/render_3D/render_3D/scene/Render_Scene_3D.hpp b/render_3D/render_3D/scene/Render_Scene_3D.hpp
index a6b9269..eb4bfd7 100644
--- a/render_3D/render_3D/scene/Render_Scene_3D.hpp
+++ b/render_3D/render_3D/scene/Render_Scene_3D.hpp
@@ -5,10 +5,12 @@
 #include "../detail/Backend_Types.hpp"
 #include "../visual/Visuals.hpp"
 #include <scene.hpp>
+#include <ownership.hpp>
 #include <array>
 #include <expected>
 #include <functional>
 #include <memory>
+#include <optional>
 #include <vector>
 namespace aethera::render_3d {
 /* 执行公共 Renderable 图，并把结果无等待地提交给 Datoviz 渲染域。 */
@@ -27,35 +29,36 @@ struct Render_Scene_3D : Def<Render_Scene_3D, Scene> {
         using Final_Builder = typename Object::template Builder<Object>;
         Builder();
         template <Attached Visual_Object>
-        Final_Builder& add_renderable(Visual_Object* visual);
+        Final_Builder& add_renderable(not_null<Visual_Object*> visual);
         template <Attached Camera_Object> requires std::derived_from<Camera_Object, Camera_3D>
-        Final_Builder& add_camera(Camera_Object* camera);
+        Final_Builder& add_camera(not_null<Camera_Object*> camera);
         template <Attached Axes_Object> requires std::derived_from<Axes_Object, Axes_3D>
-        Final_Builder& add_axes(Axes_Object* axes);
+        Final_Builder& add_axes(not_null<Axes_Object*> axes);
         Final_Builder& use_gpu(std::uint32_t gpu_index, bool validation_enabled = false);
         [[nodiscard]] std::expected<std::unique_ptr<Object>, Dependency_Graph_Error> build();
     private:
         struct Visual_Binding {
-            Root* object{}; /* 不拥有；生命周期必须覆盖 Scene。 */
+            not_null<Root*> object; /* 不拥有；生命周期必须覆盖 Scene。 */
             Visual_Family family{Visual_Family::point}; /* 创建对应 Datoviz Visual 的 family。 */
-            void (*bind)(Root*, std::shared_ptr<void>){}; /* 绑定 Scene 拥有的发布上下文。 */
+            void (*bind)(not_null<Root*>, std::shared_ptr<void>){}; /* 绑定 Scene 拥有的发布上下文。 */
         };
         std::vector<Visual_Binding> visuals{}; /* 本 Scene 的全部 Visual，注册顺序保持稳定。 */
-        Root* camera{}; /* 不拥有的 Camera 组件；生命周期必须覆盖 Scene。 */
-        Root* axes{}; /* 不拥有的三轴组件；生命周期必须覆盖 Scene。 */
-        using Camera_Read = Camera_Descriptor (*)(const Root*);
-        using Axes_Read = std::array<plot::Axis_Descriptor, 3> (*)(const Root*);
+        std::optional<not_null<Root*>> camera{}; /* 不拥有的 Camera 组件；生命周期必须覆盖 Scene。 */
+        std::optional<not_null<Root*>> axes{}; /* 不拥有的三轴组件；生命周期必须覆盖 Scene。 */
+        using Camera_Read = Camera_Descriptor (*)(not_null<const Root*>);
+        using Axes_Read = std::array<plot::Axis_Descriptor, 3> (*)(not_null<const Root*>);
         Camera_Read read_camera{};
         Axes_Read read_axes{};
         std::uint32_t gpu_index{}; /* Datoviz 使用的物理 GPU 下标。 */
         bool validation_enabled{}; /* 是否启用 Vulkan 验证。 */
     };
     enum struct Render_Result { submitted, frame_pipeline_busy, view_inactive, empty_viewport, backend_unavailable };
-    using Frame_Callback = std::function<void(Frame_3D*)>;
-    using Submitted_Frame_Callback = std::function<void(Frame_3D*, bool)>;
+    using Frame_Callback = std::function<void(not_null<Frame_3D*>)>;
+    using Submitted_Frame_Callback =
+        std::function<void(not_null<Frame_3D*>, bool)>;
     using Render_Result_Type = Render_Result;
     using Render_Frame_Type = Frame_3D;
-    [[nodiscard]] Render_Result render(Frame_3D* frame);
+    [[nodiscard]] Render_Result render(not_null<Frame_3D*> frame);
     void set_frame_callback(Frame_Callback callback);
     void set_submitted_frame_callback(Submitted_Frame_Callback callback);
     /*
diff --git a/render_3D/render_3D/scene/Render_Scene_3D.ipp b/render_3D/render_3D/scene/Render_Scene_3D.ipp
index 0f60bd2..e53fd40 100644
--- a/render_3D/render_3D/scene/Render_Scene_3D.ipp
+++ b/render_3D/render_3D/scene/Render_Scene_3D.ipp
@@ -13,7 +13,7 @@ namespace detail {
 template <Attached Object>
 struct Scene_Paint_Context {
     std::shared_ptr<Async_Render_Backend> backend{};          /* Scene 拥有、异步命令延长生命周期的后端。 */
-    Object* scene{};                                         /* 仅在 Scene 拥有本上下文期间读取当前 Prop。 */
+    not_null<Object*> scene;                                 /* 仅在 Scene 拥有本上下文期间读取当前 Prop。 */
     Scene_3D_Parameters parameters{};                        /* 当前 Prepare 读取的 Scene 参数。 */
     std::shared_ptr<Prepared_Visual_Batch> visuals{           /* 当前 Prepare 发布的数据句柄集合。 */
         std::make_shared<Prepared_Visual_Batch>()};
@@ -28,7 +28,7 @@ struct Render_Scene_3D::Private : Prev_Private {
     };
     struct Frame_Context {
         std::atomic<Frame_Phase> phase{Frame_Phase::available};
-        Frame_3D* frame{};
+        std::optional<not_null<Frame_3D*>> frame{};
         Event_Batch events{};
         bool trace_started{};
         bool overlaps_gpu{};
@@ -60,28 +60,33 @@ struct Render_Scene_3D::Private : Prev_Private {
     std::atomic<std::shared_ptr<const Submitted_Frame_Callback>> submitted_callback{};
     std::shared_ptr<detail::Async_Render_Backend> backend{};  /* Scene 拥有的异步后端；已入队命令自行延长实现寿命。 */
     std::shared_ptr<void> paint_context{};                    /* Paint 节点读取 Scene 当前 Prop 的生命周期门闩。 */
-    Root* camera_component{};                                /* Builder 绑定的 Camera 组件。 */
-    Root* axes_component{};                                  /* Builder 绑定的三轴组件。 */
-    Camera_Descriptor (*read_camera)(const Root*){};          /* 读取 Camera 当前配置。 */
-    std::array<plot::Axis_Descriptor, 3> (*read_axes)(const Root*){}; /* 读取三轴当前配置。 */
-    Frame_Context* active_context{};                         /* 只由唯一 CPU Prepare 图访问。 */
+    std::optional<not_null<Root*>> camera_component{};       /* Builder 绑定的 Camera 组件。 */
+    std::optional<not_null<Root*>> axes_component{};         /* Builder 绑定的三轴组件。 */
+    Camera_Descriptor (*read_camera)(not_null<const Root*>){}; /* 读取 Camera 当前配置。 */
+    std::array<plot::Axis_Descriptor, 3> (*read_axes)(not_null<const Root*>){}; /* 读取三轴当前配置。 */
+    std::optional<not_null<Frame_Context*>> active_context{}; /* 只由唯一 CPU Prepare 图访问。 */
     std::unique_ptr<Task_Graph> frame_taskflow{};
     /* Builder 内部初始化后端；必须在绑定 Visual Paint 目标之前调用一次。 */
     template <Attached Object>
     void initialize_backend(Object* object, std::uint32_t gpu_index, bool validation_enabled,
-                            std::vector<detail::Visual_Registration> visuals, Root* camera, Root* axes,
-                            Camera_Descriptor (*camera_reader)(const Root*),
-                            std::array<plot::Axis_Descriptor, 3> (*axes_reader)(const Root*));
+                            std::vector<detail::Visual_Registration> visuals,
+                            not_null<Root*> camera, not_null<Root*> axes,
+                            Camera_Descriptor (*camera_reader)(not_null<const Root*>),
+                            std::array<plot::Axis_Descriptor, 3> (*axes_reader)(not_null<const Root*>));
     template <Attached Object> [[nodiscard]] detail::Scene_3D_Parameters parameters(Object* object) const;
-    [[nodiscard]] Frame_Context* context_for(Frame_3D* frame) noexcept;
-    template <Attached Object> void try_release_prepare(Object* object, Frame_Context* context);
+    [[nodiscard]] std::optional<not_null<Frame_Context*>> context_for(
+        not_null<Frame_3D*> frame) noexcept;
+    template <Attached Object> void try_release_prepare(
+        Object* object, not_null<Frame_Context*> context);
     template <Attached Object> void arm_completion(Object* object);
     template <Attached Object> void consume_completion(Object* object);
-    template <Attached Object> void complete_frame(Object* object, Frame_Context* context);
+    template <Attached Object> void complete_frame(
+        Object* object, not_null<Frame_Context*> context);
     /* CRTP 覆盖：绑定 Scene 机制和 Render_Scene_3D 公开薄壳。 */
     template <Attached Object> void bind_private_crtp(Object* object);
     template <Attached Object> void ensure_frame_taskflow(Object* object);
-    template <Attached Object> [[nodiscard]] Render_Result render(Object* object, Frame_3D* frame);
+    template <Attached Object> [[nodiscard]] Render_Result render(
+        Object* object, not_null<Frame_3D*> frame);
     template <Attached Object> void set_frame_callback(Object* object, Frame_Callback callback);
     template <Attached Object> void set_submitted_frame_callback(Object* object, Submitted_Frame_Callback callback);
     template <Attached Object> void set_view_active(Object* object, bool active);
@@ -91,20 +96,20 @@ template <typename Object>
 Render_Scene_3D::Builder<Object>::Builder() : Base() {}
 template <typename Object> template <Attached Visual_Object>
 typename Render_Scene_3D::Builder<Object>::Final_Builder&
-Render_Scene_3D::Builder<Object>::add_renderable(Visual_Object* visual_value) {
-    if (!visual_value) throw std::invalid_argument("Render_Scene_3D cannot attach a null Visual");
+Render_Scene_3D::Builder<Object>::add_renderable(
+    not_null<Visual_Object*> visual_value) {
     if (std::ranges::any_of(visuals, [visual_value](const Visual_Binding& value) {
             return value.object == visual_value;
         }))
         throw std::logic_error("Render_Scene_3D cannot attach the same Visual twice");
-    Visual_Binding binding{};
-    binding.object = visual_value;
-    binding.family = Visual_Object::Attached_Object::Specification::family;
-    binding.bind = [](Root* root, std::shared_ptr<void> context) {
+    Visual_Binding binding{
+        visual_value,
+        Visual_Object::Attached_Object::Specification::family,
+        [](not_null<Root*> root, std::shared_ptr<void> context) {
         using Definition = typename Visual_Object::Attached_Object;
         using Prepared = typename Definition::Prepared_Visual;
-        auto* object = static_cast<Visual_Object*>(root);
-        Base::private_access(object).template get<typename Definition::Base_Tag>()
+        const not_null object{static_cast<Visual_Object*>(root.get())};
+        Base::private_access(object.get()).template get<typename Definition::Base_Tag>()
             .bind_paint_target(std::move(context), [](void* raw_context, const Root* identity,
                                                        const Prepared& prepared) {
                 auto& submission = *static_cast<detail::Scene_Paint_Context<Object>*>(raw_context);
@@ -121,22 +126,22 @@ Render_Scene_3D::Builder<Object>::add_renderable(Visual_Object* visual_value) {
                  * 的 visual 成员，不扩容容器，也不互相读写同一对象。 */
                 found->visual = std::move(erased);
             });
-    };
+        }};
     visuals.push_back(binding);
-    this->template add_dependency_node<Render_Graph_Tag>(visual_value);
+    this->template add_dependency_node<Render_Graph_Tag>(visual_value.get());
     return static_cast<Final_Builder&>(*this);
 }
 template <typename Object> template <Attached Camera_Object>
     requires std::derived_from<Camera_Object, Camera_3D>
 typename Render_Scene_3D::Builder<Object>::Final_Builder&
-Render_Scene_3D::Builder<Object>::add_camera(Camera_Object* camera_value) {
-    if (!camera_value) throw std::invalid_argument("Render_Scene_3D cannot attach a null Camera");
+Render_Scene_3D::Builder<Object>::add_camera(
+    not_null<Camera_Object*> camera_value) {
     if (camera) throw std::logic_error("Render_Scene_3D accepts one Camera component");
     camera = camera_value;
-    read_camera = [](const Root* root) {
-        const auto* object = static_cast<const Camera_Object*>(root);
+    read_camera = [](not_null<const Root*> root) {
+        const not_null object{static_cast<const Camera_Object*>(root.get())};
         const Camera_3D::Prop& prop =
-            Base::template current_prop<Camera_3D::Base_Tag>(object);
+            Base::template current_prop<Camera_3D::Base_Tag>(object.get());
         return Camera_Descriptor{prop.initial_view, prop.projection, prop.controller,
                                        prop.turntable_control, prop.arcball_control,
                                        prop.fly_control, prop.panzoom_control,
@@ -148,14 +153,14 @@ Render_Scene_3D::Builder<Object>::add_camera(Camera_Object* camera_value) {
 template <typename Object> template <Attached Axes_Object>
     requires std::derived_from<Axes_Object, Axes_3D>
 typename Render_Scene_3D::Builder<Object>::Final_Builder&
-Render_Scene_3D::Builder<Object>::add_axes(Axes_Object* axes_value) {
-    if (!axes_value) throw std::invalid_argument("Render_Scene_3D cannot attach null Axes");
+Render_Scene_3D::Builder<Object>::add_axes(
+    not_null<Axes_Object*> axes_value) {
     if (axes) throw std::logic_error("Render_Scene_3D accepts one Axes component");
     axes = axes_value;
-    read_axes = [](const Root* root) {
-        const auto* object = static_cast<const Axes_Object*>(root);
+    read_axes = [](not_null<const Root*> root) {
+        const not_null object{static_cast<const Axes_Object*>(root.get())};
         const Axes_3D::Prop& prop =
-            Base::template current_prop<Axes_3D::Base_Tag>(object);
+            Base::template current_prop<Axes_3D::Base_Tag>(object.get());
         return std::array<plot::Axis_Descriptor, 3>{prop.x_axis, prop.y_axis, prop.z_axis};
     };
     return static_cast<Final_Builder&>(*this);
@@ -180,9 +185,12 @@ std::expected<std::unique_ptr<Object>, Dependency_Graph_Error> Render_Scene_3D::
     std::vector<detail::Visual_Registration> registrations;
     registrations.reserve(visuals.size());
     for (const auto& visual : visuals)
-        registrations.push_back({reinterpret_cast<detail::Visual_Identity>(visual.object), visual.family});
+        registrations.push_back({
+            reinterpret_cast<detail::Visual_Identity>(visual.object.get()),
+            visual.family});
     private_data.initialize_backend(scene.get(), gpu_index, validation_enabled, std::move(registrations),
-                                    camera, axes, read_camera, read_axes);
+                                    camera.value(), axes.value(), read_camera,
+                                    read_axes);
     for (const auto& visual : visuals) visual.bind(visual.object, private_data.paint_context);
     return scene;
 }
@@ -190,13 +198,14 @@ template <Attached Object>
 detail::Scene_3D_Parameters Render_Scene_3D::Private::parameters(Object* object) const {
     const Prop& prop = static_cast<const Prop&>(
         double_buffer::detail::Internal_Access::current_prop(object));
-    const auto axis = read_axes(axes_component);
-    return {prop.viewport, prop.clear_color, read_camera(camera_component), axis[0], axis[1], axis[2]};
+    const auto axis = read_axes(axes_component.value());
+    return {prop.viewport, prop.clear_color,
+            read_camera(camera_component.value()), axis[0], axis[1], axis[2]};
 }
 template <Attached Object>
 void Render_Scene_3D::Private::complete_frame(
-    Object*, Frame_Context* context) {
-    auto* frame = context->frame;
+    Object*, not_null<Frame_Context*> context) {
+    const auto frame = context->frame.value();
     const auto callback = frame_callback.load(std::memory_order_acquire);
     frame->mark(Frame_Trace_Marker::frame_ready);
     if (context->trace_started)
@@ -204,7 +213,7 @@ void Render_Scene_3D::Private::complete_frame(
 
     /* Scene 仅借用外部 Frame。完成通知前必须先清除所有借用引用并开放
      * Frame_Context；回调之后是否发布、统计或复用只由调用方帧策略决定。 */
-    context->frame = nullptr;
+    context->frame.reset();
     context->events.clear();
     context->failure = {};
     context->trace_started = false;
@@ -216,16 +225,18 @@ void Render_Scene_3D::Private::complete_frame(
     if (callback && *callback) (*callback)(frame);
 }
 
-inline Render_Scene_3D::Private::Frame_Context*
-Render_Scene_3D::Private::context_for(Frame_3D* frame) noexcept {
+inline std::optional<not_null<Render_Scene_3D::Private::Frame_Context*>>
+Render_Scene_3D::Private::context_for(not_null<Frame_3D*> frame) noexcept {
     const auto found = std::ranges::find(frame_contexts, frame,
         &Frame_Context::frame);
-    return found == frame_contexts.end() ? nullptr : &*found;
+    return found == frame_contexts.end()
+        ? std::optional<not_null<Frame_Context*>>{}
+        : std::optional<not_null<Frame_Context*>>{not_null{&*found}};
 }
 
 template <Attached Object>
 void Render_Scene_3D::Private::try_release_prepare(
-    Object* object, Frame_Context* context) {
+    Object* object, not_null<Frame_Context*> context) {
     if (!context->cpu_finished.load(std::memory_order_acquire) ||
         !context->gpu_submitted.load(std::memory_order_acquire) ||
         (!context->overlaps_gpu &&
@@ -240,7 +251,7 @@ void Render_Scene_3D::Private::try_release_prepare(
     if (const auto callback =
             submitted_callback.load(std::memory_order_acquire);
         callback && *callback)
-        (*callback)(context->frame, context->overlaps_gpu);
+        (*callback)(context->frame.value(), context->overlaps_gpu);
     if (context->gpu_completed.load(std::memory_order_acquire))
         arm_completion(object);
 }
@@ -259,15 +270,15 @@ void Render_Scene_3D::Private::arm_completion(Object* object) {
 
 template <Attached Object>
 void Render_Scene_3D::Private::consume_completion(Object* object) {
-    Frame_Context* selected{};
+    std::optional<not_null<Frame_Context*>> selected{};
     for (auto& context : frame_contexts) {
         if (context.phase.load(std::memory_order_acquire) !=
                 Frame_Phase::submitted ||
             !context.gpu_completed.load(std::memory_order_acquire))
             continue;
-        if (!selected || context.frame->identity().sequence <
-                             selected->frame->identity().sequence)
-            selected = &context;
+        if (!selected || context.frame.value()->identity().sequence <
+                             (*selected)->frame.value()->identity().sequence)
+            selected = not_null{&context};
     }
     if (!selected) {
         completion_busy.store(false, std::memory_order_release);
@@ -280,17 +291,17 @@ void Render_Scene_3D::Private::consume_completion(Object* object) {
         return;
     }
     auto expected = Frame_Phase::submitted;
-    if (!selected->phase.compare_exchange_strong(
+    if (!(*selected)->phase.compare_exchange_strong(
             expected, Frame_Phase::completing, std::memory_order_acq_rel,
             std::memory_order_acquire)) {
         completion_busy.store(false, std::memory_order_release);
         arm_completion(object);
         return;
     }
-    auto* frame = selected->frame;
+    const auto frame = (*selected)->frame.value();
     frame->mark(Frame_Trace_Marker::paint_finished);
     frame->mark(Frame_Trace_Marker::scene_render_finished);
-    auto done = [this, object, selected] {
+    auto done = [this, object, selected = *selected] {
         complete_frame(object, selected);
         completion_busy.store(false, std::memory_order_release);
         arm_completion(object);
@@ -309,8 +320,9 @@ template <Attached Object>
 void Render_Scene_3D::Private::initialize_backend(
     Object* object, std::uint32_t gpu_index, bool validation_enabled,
     std::vector<detail::Visual_Registration> visuals,
-    Root* camera, Root* axes, Camera_Descriptor (*camera_reader)(const Root*),
-    std::array<plot::Axis_Descriptor, 3> (*axes_reader)(const Root*)) {
+    not_null<Root*> camera, not_null<Root*> axes,
+    Camera_Descriptor (*camera_reader)(not_null<const Root*>),
+    std::array<plot::Axis_Descriptor, 3> (*axes_reader)(not_null<const Root*>)) {
     camera_component = camera;
     axes_component = axes;
     read_camera = camera_reader;
@@ -338,12 +350,12 @@ void Render_Scene_3D::Private::ensure_frame_taskflow(Object* object) {
     graph.describe("owner_kind", "scene")
          .describe("owner_component", "scene");
     auto begin = graph.add("scene.begin", [this, object] {
-        if (!active_context || !active_context->frame)
+        if (!active_context || !(*active_context)->frame)
             throw std::logic_error("3D frame DAG lost its active frame");
-        auto* frame = active_context->frame;
+        const auto frame = (*active_context)->frame.value();
         frame->mark(Frame_Trace_Marker::scene_render_started);
         frame->mark(Frame_Trace_Marker::event_dispatch_started);
-        active_context->events = take_events(object);
+        (*active_context)->events = take_events(object);
         frame->mark(Frame_Trace_Marker::event_dispatch_finished);
 
         auto context = std::static_pointer_cast<
@@ -360,8 +372,8 @@ void Render_Scene_3D::Private::ensure_frame_taskflow(Object* object) {
         if (context->visuals.use_count() != 1)
             context->visuals =
                 std::make_shared<detail::Prepared_Visual_Batch>(*context->visuals);
-        camera_component->advance_object();
-        axes_component->advance_object();
+        camera_component.value()->advance_object();
+        axes_component.value()->advance_object();
         frame->mark(Frame_Trace_Marker::prepare_started);
         frame->mark(Frame_Trace_Marker::prepare_finished);
         frame->mark(Frame_Trace_Marker::paint_started);
@@ -374,8 +386,8 @@ void Render_Scene_3D::Private::ensure_frame_taskflow(Object* object) {
                .describe("execution_domain", "Taskflow workers");
 
     auto submit = graph.add("scene.backend.submit", [this, object] {
-        auto* execution = active_context;
-        if (!execution || !execution->frame)
+        const auto execution = active_context;
+        if (!execution || !(*execution)->frame)
             throw std::logic_error("3D submit lost its frame context");
         auto context = std::static_pointer_cast<
             detail::Scene_Paint_Context<Object>>(paint_context);
@@ -386,36 +398,36 @@ void Render_Scene_3D::Private::ensure_frame_taskflow(Object* object) {
             double_buffer::detail::Internal_Access::pending_state(object));
         state.event_statistics = event_statistics.state();
         context->backend->render(
-            context->visuals, context->parameters, execution->frame,
-            std::move(execution->events),
-            [this, object](Frame_3D* submitted, bool overlaps_gpu) {
-                auto* frame_context = context_for(submitted);
+            context->visuals, context->parameters,
+            (*execution)->frame.value(), std::move((*execution)->events),
+            [this, object](not_null<Frame_3D*> submitted, bool overlaps_gpu) {
+                const auto frame_context = context_for(submitted);
                 if (!frame_context)
                     throw std::logic_error(
                         "3D backend submitted a frame not borrowed by Scene");
-                frame_context->overlaps_gpu = overlaps_gpu;
-                frame_context->gpu_submitted.store(
+                (*frame_context)->overlaps_gpu = overlaps_gpu;
+                (*frame_context)->gpu_submitted.store(
                     true, std::memory_order_release);
-                try_release_prepare(object, frame_context);
+                try_release_prepare(object, *frame_context);
             },
-            [this, object](Frame_3D* completed,
+            [this, object](not_null<Frame_3D*> completed,
                            std::exception_ptr failure) {
-                auto* frame_context = context_for(completed);
+                const auto frame_context = context_for(completed);
                 if (!frame_context)
                     throw std::logic_error(
                         "3D backend completed a frame not borrowed by Scene");
-                frame_context->failure = std::move(failure);
-                if (frame_context->failure &&
-                    !frame_context->gpu_submitted.load(
+                (*frame_context)->failure = std::move(failure);
+                if ((*frame_context)->failure &&
+                    !(*frame_context)->gpu_submitted.load(
                         std::memory_order_acquire)) {
-                    frame_context->overlaps_gpu = false;
-                    frame_context->gpu_submitted.store(
+                    (*frame_context)->overlaps_gpu = false;
+                    (*frame_context)->gpu_submitted.store(
                         true, std::memory_order_release);
                 }
-                frame_context->gpu_completed.store(
+                (*frame_context)->gpu_completed.store(
                     true, std::memory_order_release);
-                try_release_prepare(object, frame_context);
-                if (frame_context->phase.load(std::memory_order_acquire) ==
+                try_release_prepare(object, *frame_context);
+                if ((*frame_context)->phase.load(std::memory_order_acquire) ==
                     Frame_Phase::submitted)
                     arm_completion(object);
             });
@@ -427,8 +439,8 @@ void Render_Scene_3D::Private::ensure_frame_taskflow(Object* object) {
     renderables.precede(submit);
 }
 template <Attached Object>
-Render_Scene_3D::Render_Result Render_Scene_3D::Private::render(Object* object, Frame_3D* frame) {
-    if (!frame) throw std::invalid_argument("Render_Scene_3D requires a non-null external frame");
+Render_Scene_3D::Render_Result Render_Scene_3D::Private::render(
+    Object* object, not_null<Frame_3D*> frame) {
     frame->mark(Frame_Trace_Marker::scene_render_entered);
     const auto callback = frame_callback.load(std::memory_order_acquire);
     if (!callback || !*callback)
@@ -439,13 +451,13 @@ Render_Scene_3D::Render_Result Render_Scene_3D::Private::render(Object* object,
             inactive, true, std::memory_order_acq_rel,
             std::memory_order_acquire))
         return Render_Result::frame_pipeline_busy;
-    Frame_Context* execution{};
+    std::optional<not_null<Frame_Context*>> execution{};
     for (auto& context : frame_contexts) {
         auto expected = Frame_Phase::available;
         if (context.phase.compare_exchange_strong(
                 expected, Frame_Phase::preparing,
                 std::memory_order_acq_rel, std::memory_order_acquire)) {
-            execution = &context;
+            execution = not_null{&context};
             break;
         }
     }
@@ -453,18 +465,18 @@ Render_Scene_3D::Render_Result Render_Scene_3D::Private::render(Object* object,
         prepare_active.store(false, std::memory_order_release);
         return Render_Result::frame_pipeline_busy;
     }
-    execution->frame = frame;
-    execution->events.clear();
-    execution->failure = {};
-    execution->trace_started = false;
-    execution->overlaps_gpu = false;
-    execution->cpu_finished.store(false, std::memory_order_relaxed);
-    execution->gpu_submitted.store(false, std::memory_order_relaxed);
-    execution->gpu_completed.store(false, std::memory_order_relaxed);
-    active_context = execution;
-    const auto reject_frame = [this, execution](Render_Result result) {
-        active_context = nullptr;
-        execution->frame = nullptr;
+    (*execution)->frame = frame;
+    (*execution)->events.clear();
+    (*execution)->failure = {};
+    (*execution)->trace_started = false;
+    (*execution)->overlaps_gpu = false;
+    (*execution)->cpu_finished.store(false, std::memory_order_relaxed);
+    (*execution)->gpu_submitted.store(false, std::memory_order_relaxed);
+    (*execution)->gpu_completed.store(false, std::memory_order_relaxed);
+    active_context = *execution;
+    const auto reject_frame = [this, execution = *execution](Render_Result result) {
+        active_context.reset();
+        execution->frame.reset();
         execution->phase.store(Frame_Phase::available, std::memory_order_release);
         prepare_active.store(false, std::memory_order_release);
         return result;
@@ -491,16 +503,17 @@ Render_Scene_3D::Render_Result Render_Scene_3D::Private::render(Object* object,
         throw;
     }
     frame->mark(Frame_Trace_Marker::scene_render_requested);
-    execution->trace_started = aethera::detail::begin_taskflow_trace(*frame);
+    (*execution)->trace_started =
+        aethera::detail::begin_taskflow_trace(*frame);
     try {
-        auto completion = [this, object, execution] {
+        auto completion = [this, object, execution = *execution] {
             double_buffer::detail::Internal_Access::
                 current_dependency_graph<Render_Graph_Tag>(object).for_each_bound(
                     [](Renderable* renderable, Renderable::Private& data) {
                         data.publish_renderable_state(renderable);
                     });
             double_buffer::detail::Internal_Access::publish_state<Render_Scene_3D::Base_Tag>(object);
-            active_context = nullptr;
+            active_context.reset();
             execution->cpu_finished.store(true, std::memory_order_release);
             try_release_prepare(object, execution);
         };
@@ -511,9 +524,9 @@ Render_Scene_3D::Render_Result Render_Scene_3D::Private::render(Object* object,
             aethera::detail::run_taskflow(*frame_taskflow, std::move(completion));
     }
     catch (...) {
-        if (execution->trace_started) {
+        if ((*execution)->trace_started) {
             aethera::detail::finish_taskflow_trace(*frame);
-            execution->trace_started = false;
+            (*execution)->trace_started = false;
         }
         reject_frame(Render_Result::backend_unavailable);
         throw;
diff --git a/render_3D/tests/Visual_Tests.cpp b/render_3D/tests/Visual_Tests.cpp
index 30aacd4..275019e 100644
--- a/render_3D/tests/Visual_Tests.cpp
+++ b/render_3D/tests/Visual_Tests.cpp
@@ -40,7 +40,9 @@ TEST(Render_3D_Scene, Builder_Instantiates_Async_Paint_Contract) {
     auto camera = *Camera_3D::Builder<Camera_3D>{}.build();
     auto axes = *Axes_3D::Builder<Axes_3D>{}.build();
     typename Scene_Object::template Builder<Scene_Object> scene_builder;
-    scene_builder.add_renderable(visual.get()).add_camera(camera.get()).add_axes(axes.get());
+    scene_builder.add_renderable(not_null{visual.get()})
+        .add_camera(not_null{camera.get()})
+        .add_axes(not_null{axes.get()});
     static_assert(std::same_as<decltype(scene_builder.build()), std::expected<std::unique_ptr<Scene_Object>, Dependency_Graph_Error>>);
 }
 TEST(Render_3D_Visual, Prepared_Data_Preserves_Datoviz_Attributes) {
diff --git a/web_server/src/Gallery_Video_Stream.cpp b/web_server/src/Gallery_Video_Stream.cpp
index 7d1310a..8966f96 100644
--- a/web_server/src/Gallery_Video_Stream.cpp
+++ b/web_server/src/Gallery_Video_Stream.cpp
@@ -284,8 +284,8 @@ void Gallery_Video_Stream::Private::update_metrics(
     metric_pixel_start = pixel_frame_count;
     metric_sample_start = sampler_state.sampled_frames;
     metric_clock_start = clock_total;
-    object->template update_state<&State::diagnostics>(std::move(output));
-    object->template publish_state<Base_Tag>();
+    (*object)->template update_state<&State::diagnostics>(std::move(output));
+    (*object)->template publish_state<Base_Tag>();
 }
 void Gallery_Video_Stream::Private::sample_media_frame() {
     active_sample.reset();
diff --git a/web_server/src/Gallery_Video_Stream.ipp b/web_server/src/Gallery_Video_Stream.ipp
index ab58cdc..bc5d156 100644
--- a/web_server/src/Gallery_Video_Stream.ipp
+++ b/web_server/src/Gallery_Video_Stream.ipp
@@ -1,6 +1,7 @@
 #pragma once
 #include "frame_sampling/Frame_Sampler.hpp"
 #include <frame_statistics.hpp>
+#include <ownership.hpp>
 #include <atomic>
 #include <chrono>
 namespace aethera::web {
@@ -19,7 +20,7 @@ struct Gallery_Video_Stream::Private : Prev_Private {
         std::shared_ptr<const Transport_Diagnostics> diagnostics{}; /* 连接自己的传输诊断来源。 */
     };
     using Consumers = std::vector<Consumer>;
-    Object* object{}; /* Def 机制所属最终对象。 */
+    std::optional<not_null<Object*>> object{}; /* Def 机制所属最终对象；bind_private_crtp 后有效。 */
     Sliding_Statistics compose_ms{600}; /* 图集采样与变更槽复制统计计算器。 */
     Sliding_Statistics sample_delay_ms{600}; /* 固定 deadline 到实际采样的调度延迟。 */
     Sliding_Statistics encode_ms{600}; /* H.264 编码统计计算器。 */
@@ -54,7 +55,7 @@ struct Gallery_Video_Stream::Private : Prev_Private {
     template <Attached Attached_Object>
     void bind_private_crtp(Attached_Object* attached) {
         Prev_Private::bind_private_crtp(attached);
-        object = static_cast<Object*>(attached);
+        object = not_null{static_cast<Object*>(attached)};
     }
     void initialize(std::vector<Plot_Entry> plots);
     [[nodiscard]] bool consumer_accepts(
diff --git a/web_server/src/H264_Encoder.cpp b/web_server/src/H264_Encoder.cpp
index 4e1ffde..61d34b9 100644
--- a/web_server/src/H264_Encoder.cpp
+++ b/web_server/src/H264_Encoder.cpp
@@ -1,4 +1,5 @@
 #include "H264_Encoder.hpp"
+#include <ownership.hpp>
 #include <algorithm>
 #include <array>
 #include <cmath>
@@ -138,12 +139,12 @@ struct H264_Encoder::Private {
     }
 
     double frame_rate{};                                    /* 页面媒体时钟频率，也是 GOP 的计算基准。 */
-    AVCodecContext* codec_context{};                         /* 当前图集尺寸对应的唯一硬件编码上下文。 */
-    AVFrame* software_frame{};                               /* 当前硬件路径需要的复用 CPU 输入帧。 */
-    AVPacket* packet{};                                     /* 接收单个 H.264 access unit 的复用包。 */
-    AVBufferRef* hardware_device{};                          /* Vulkan Video 后端的 FFmpeg Device。 */
-    AVBufferRef* hardware_frames{};                          /* Vulkan Video NV12 帧池。 */
-    SwsContext* converter{};                                /* Vulkan Video 的 RGBA/BGRA 到 NV12 转换器。 */
+    owner<AVCodecContext*> codec_context{};                  /* 当前图集尺寸对应的唯一硬件编码上下文。 */
+    owner<AVFrame*> software_frame{};                        /* 当前硬件路径需要的复用 CPU 输入帧。 */
+    owner<AVPacket*> packet{};                              /* 接收单个 H.264 access unit 的复用包。 */
+    owner<AVBufferRef*> hardware_device{};                   /* Vulkan Video 后端的 FFmpeg Device。 */
+    owner<AVBufferRef*> hardware_frames{};                   /* Vulkan Video NV12 帧池。 */
+    owner<SwsContext*> converter{};                          /* Vulkan Video 的 RGBA/BGRA 到 NV12 转换器。 */
     std::optional<Video_Encoder_Backend> backend{};          /* 当前成功配置的唯一实际编码后端。 */
     std::deque<Submitted_Frame> submitted_frames{};          /* 延迟输出 access unit 的身份队列。 */
     std::uint32_t width{};                                  /* 当前硬件编码图集宽度。 */
@@ -221,12 +222,13 @@ struct H264_Encoder::Private {
     Configuration configure_nvenc(std::uint32_t next_width,
                                   std::uint32_t next_height,
                                   Video_Pixel_Layout next_layout) const {
-        const AVCodec* codec = avcodec_find_encoder_by_name("h264_nvenc");
-        if (!codec)
+        const auto codec_address = avcodec_find_encoder_by_name("h264_nvenc");
+        if (!codec_address)
             throw std::runtime_error("FFmpeg h264_nvenc encoder is unavailable");
+        const not_null<const AVCodec*> codec{codec_address};
         Configuration result;
         result.backend = Video_Encoder_Backend::nvenc;
-        result.codec_context.reset(avcodec_alloc_context3(codec));
+        result.codec_context.reset(avcodec_alloc_context3(codec.get()));
         if (!result.codec_context) throw std::bad_alloc{};
         configure_common(*result.codec_context, next_width, next_height,
                          input_pixel_format(next_layout));
@@ -263,7 +265,7 @@ struct H264_Encoder::Private {
         require_ffmpeg(av_opt_set_int(result.codec_context->priv_data,
                                       "no-scenecut", 1, 0),
                        "disabling NVENC scene-cut frames");
-        require_ffmpeg(avcodec_open2(result.codec_context.get(), codec, nullptr),
+        require_ffmpeg(avcodec_open2(result.codec_context.get(), codec.get(), nullptr),
                        "opening h264_nvenc encoder");
         result.software_frame = make_software_frame(
             result.codec_context->pix_fmt, next_width, next_height,
@@ -276,12 +278,13 @@ struct H264_Encoder::Private {
     Configuration configure_vulkan(std::uint32_t next_width,
                                    std::uint32_t next_height,
                                    Video_Pixel_Layout next_layout) const {
-        const AVCodec* codec = avcodec_find_encoder_by_name("h264_vulkan");
-        if (!codec)
+        const auto codec_address = avcodec_find_encoder_by_name("h264_vulkan");
+        if (!codec_address)
             throw std::runtime_error("FFmpeg h264_vulkan encoder is unavailable");
+        const not_null<const AVCodec*> codec{codec_address};
         Configuration result;
         result.backend = Video_Encoder_Backend::vulkan_video;
-        AVBufferRef* device{};
+        owner<AVBufferRef*> device{};
         require_ffmpeg(av_hwdevice_ctx_create(
                            &device, AV_HWDEVICE_TYPE_VULKAN,
                            nullptr, nullptr, 0),
@@ -290,8 +293,9 @@ struct H264_Encoder::Private {
         result.hardware_frames.reset(
             av_hwframe_ctx_alloc(result.hardware_device.get()));
         if (!result.hardware_frames) throw std::bad_alloc{};
-        auto* frames = reinterpret_cast<AVHWFramesContext*>(
-            result.hardware_frames->data);
+        const not_null<AVHWFramesContext*> frames{
+            reinterpret_cast<AVHWFramesContext*>(
+                result.hardware_frames->data)};
         frames->format = AV_PIX_FMT_VULKAN;
         frames->sw_format = AV_PIX_FMT_NV12;
         frames->width = static_cast<int>(next_width);
@@ -300,7 +304,7 @@ struct H264_Encoder::Private {
         require_ffmpeg(av_hwframe_ctx_init(result.hardware_frames.get()),
                        "creating the Vulkan Video NV12 frame pool");
 
-        result.codec_context.reset(avcodec_alloc_context3(codec));
+        result.codec_context.reset(avcodec_alloc_context3(codec.get()));
         if (!result.codec_context) throw std::bad_alloc{};
         configure_common(*result.codec_context, next_width, next_height,
                          AV_PIX_FMT_VULKAN);
@@ -331,7 +335,7 @@ struct H264_Encoder::Private {
         require_ffmpeg(av_opt_set_int(result.codec_context->priv_data,
                                       "async_depth", 3, 0),
                        "setting Vulkan Video pipeline depth");
-        require_ffmpeg(avcodec_open2(result.codec_context.get(), codec, nullptr),
+        require_ffmpeg(avcodec_open2(result.codec_context.get(), codec.get(), nullptr),
                        "opening h264_vulkan encoder");
 
         result.software_frame = make_software_frame(
@@ -488,10 +492,10 @@ std::optional<Encoded_Video_Frame> H264_Encoder::encode(
     d->fill_software_frame(pixels);
 
     Frame_Owner hardware_frame;
-    AVFrame* input = d->software_frame;
+    not_null<AVFrame*> input{d->software_frame};
     if (d->backend == Video_Encoder_Backend::vulkan_video) {
         hardware_frame = d->make_vulkan_frame();
-        input = hardware_frame.get();
+        input = not_null{hardware_frame.get()};
     }
     input->pts = presentation_time.count();
     input->duration = static_cast<std::int64_t>(
@@ -501,7 +505,7 @@ std::optional<Encoded_Video_Frame> H264_Encoder::encode(
                            : AV_PICTURE_TYPE_NONE;
 
     d->submitted_frames.push_back({sequence, presentation_time});
-    const int submitted = avcodec_send_frame(d->codec_context, input);
+    const int submitted = avcodec_send_frame(d->codec_context, input.get());
     if (submitted < 0) {
         d->submitted_frames.pop_back();
         throw ffmpeg_failure("submitting a frame to the hardware encoder",
@@ -515,9 +519,9 @@ std::optional<Encoded_Video_Frame> H264_Encoder::encode(
                    "receiving a H.264 access unit from the hardware encoder");
 
     struct Packet_Unref_Scope {
-        AVPacket* packet{};                                 /* 输出复制完成或抛出后统一归还复用包。 */
-        ~Packet_Unref_Scope() { av_packet_unref(packet); }
-    } packet_scope{d->packet};
+        not_null<AVPacket*> packet;                         /* 输出复制完成或抛出后统一归还复用包。 */
+        ~Packet_Unref_Scope() { av_packet_unref(packet.get()); }
+    } packet_scope{not_null{d->packet}};
 
     if (d->submitted_frames.empty())
         throw std::logic_error("hardware encoder produced an uncorrelated frame");
diff --git a/web_server/tests/Gallery_Plots_Tests.cpp b/web_server/tests/Gallery_Plots_Tests.cpp
index 6c2bd6f..ee32acb 100644
--- a/web_server/tests/Gallery_Plots_Tests.cpp
+++ b/web_server/tests/Gallery_Plots_Tests.cpp
@@ -19,13 +19,15 @@ TEST(Gallery_Plots, Catalog_Is_Complete_And_Unique) {
         EXPECT_NE(definition.create, nullptr);
         EXPECT_TRUE(identifiers.insert(definition.id).second)
             << "duplicate plot id: " << definition.id;
-        EXPECT_EQ(find_gallery_plot_definition(definition.id), &definition);
+        const auto found = find_gallery_plot_definition(definition.id);
+        ASSERT_TRUE(found);
+        EXPECT_EQ(found->get(), &definition);
         has_2d |= definition.dimension == Plot_Dimension::two_d;
         has_3d |= definition.dimension == Plot_Dimension::three_d;
     }
     EXPECT_TRUE(has_2d);
     EXPECT_TRUE(has_3d);
-    EXPECT_EQ(find_gallery_plot_definition("not-a-plot"), nullptr);
+    EXPECT_FALSE(find_gallery_plot_definition("not-a-plot"));
 }
 }
 }