Summary

Third and final follow-up from the PR #225 self-review. Closes the latent pre-existing race the review flagged — NotifyChanged() was not protected against the node being disposed mid-call.

The race

Every public mutator (Append, AppendLine, AppendTracked, Remove, Replace, Clear, ScrollUp/Down/ToBottom) ends with NotifyChanged() → _invalidated.OnNext(Unit.Default). The mutator releases _contentLock before calling NotifyChanged. Dispose() runs _invalidated.OnCompleted() and _invalidated.Dispose() outside the lock (lines 791-792). So:

1. Thread A: `Append` acquires lock, mutates, releases lock.
2. Thread B: `Dispose` acquires lock, sets `_disposed=true`, releases lock.
3. Thread B: `_invalidated.OnCompleted()` + `_invalidated.Dispose()`.
4. Thread A: `NotifyChanged` → `_invalidated.OnNext(Unit.Default)` → ObjectDisposedException from `R3.Subject.OnNext` (empirically verified).

The same shape applies to a deliberate use-after-dispose call.

Fix

```csharp
private void NotifyChanged()
{
if (_disposed) return;
try
{
_invalidated.OnNext(Unit.Default);
}
catch (ObjectDisposedException)
{
// Lost the disposal race — expected.
}
}
```

Also routes `OnAnimationInvalidated`'s notification through `NotifyChanged` (instead of inlining `_invalidated.OnNext`) so the animation path inherits the same hardening AND so any future cross-cutting hook at NotifyChanged covers both paths. Resolves the "animation path bypasses NotifyChanged" divergence the earlier review surfaced (#7).

Verification

• Negative test: temporarily replaced the guard with bare `_invalidated.OnNext(Unit.Default)` and ran the 12-case parameterized suite. 11 of 12 cases failed with `ObjectDisposedException` (the 2 that passed are `Remove`/`Replace` with a non-existent SegmentId, which return `false` before reaching NotifyChanged). Restored guard → all 12 pass.
• Concurrent stress test: `Append` hammered on a background thread for 250ms wall-clock while the main thread disposes mid-flight — no exception.

Tests added

• `PublicMutator_AfterDispose_DoesNotThrow` (12 parameterized cases, one per public mutator)
• `Append_ConcurrentWithDispose_DoesNotThrow` (bounded stress test)

Test plan

• Negative test confirms guard catches the bug (11/12 cases fail without it)
• Full suite 1138/1138 pass with guard restored
• Streaming thread-safety tests (19) pass in ~1s — no perf regression
• CI green on PR

Performance impact

`NotifyChanged` adds one volatile bool read on the hot path. The try/catch block adds no runtime cost when no exception is thrown (try is free; catch only allocates on the disposal-race miss). Negligible.