[patch] Correct the stale Hexa Widgets.Extras note in CLAUDE.md

[matt-edmondson]

Refs #384. Does not close it — the remaining work there is a packaging decision that needs your call.

What

CLAUDE.md described Hexa.NET.ImGui.Widgets.Extras as "referenced for a future tier but not yet used by any Tier 1 widget." It is used, by ImGui.Widgets/Editors/CurveField.cs and ImGui.Widgets/Editors/BezierEditor.cs. A reader was being told the reference is removable for free when it is not — which is exactly the misreading #384 asks to prevent.

The replacement records three things: the two call sites, what the reference actually costs, and the dead end that shouldn't be rediscovered.

Measurements behind the new wording

The Roslyn weight is real. A fresh restore of ImGui.Widgets.csproj (obj/project.assets.json, net10.0) resolves 30 packages, 5 of them Roslyn, reached via Hexa.NET.ImGui.Widgets.Extras 1.0.9 → Microsoft.CodeAnalysis.CSharp.Scripting 4.14.0:

Microsoft.CodeAnalysis.Analyzers/3.11.0
Microsoft.CodeAnalysis.CSharp.Scripting/4.14.0
Microsoft.CodeAnalysis.CSharp/4.14.0
Microsoft.CodeAnalysis.Common/4.14.0
Microsoft.CodeAnalysis.Scripting.Common/4.14.0

But it is a restore/publish cost, not a runtime one. I walked the IL of every method body in Hexa.NET.ImGui.Widgets.Extras 1.0.9 (366 bodies, 0 skipped) looking for tokens resolving into a Microsoft.CodeAnalysis* assembly. Nine methods reference Roslyn, all on one type:

TextEditor.Highlight.CSharp.CSharpSyntaxHighlight::.cctor
TextEditor.Highlight.CSharp.CSharpSyntaxHighlight::AddSpan
TextEditor.Highlight.CSharp.CSharpSyntaxHighlight::FindMatches
TextEditor.Highlight.CSharp.CSharpSyntaxHighlight::HandleExpression
TextEditor.Highlight.CSharp.CSharpSyntaxHighlight::HandleMethodBody
TextEditor.Highlight.CSharp.CSharpSyntaxHighlight::HandleNode
TextEditor.Highlight.CSharp.CSharpSyntaxHighlight::HandleParameterList
TextEditor.Highlight.CSharp.CSharpSyntaxHighlight::HandleStatement
TextEditor.Highlight.CSharp.CSharpSyntaxHighlight::HandleToken

ImGuiCurveEditor and ImGuiBezierWidget — the only two types this repo calls — never touch it, and .NET loads assemblies lazily, so nothing here faults a Roslyn assembly in at runtime.

Option 2 from #384 does not work. dotnet pack on ImGui.Widgets shows the produced nuspec lists only direct dependencies; Roslyn is already absent from it. Consumers get Roslyn from Hexa.NET.ImGui.Widgets.Extras' own nuspec, which declares Microsoft.CodeAnalysis.CSharp.Scripting 4.14.0 directly. ExcludeAssets/PrivateAssets are local to the project that sets them and do not flow downstream, so no setting here can prune a dependency's own dependencies from a consumer's restore. That leaves options 1 and 3, which is the decision I've left on the issue.

Testing

Documentation only — no code changes, so there is nothing to add a test against. The claims in the new text are the measurements above, each reproducible from a clean checkout.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FrbYB3Qv8zvJfGCGbqr4dk

---

Generated by Claude Code

[matt-edmondson]

CI: github-advanced-security is red, and it is not this PR's

Recording this once so it isn't re-diagnosed. The two checks that actually examine the code both passed on 1341a64:

• PR #434 (code scanning / CodeQL) — success
• Code Quality: PR #434 — success

The only red check is github-advanced-security ("Code scanning AI findings on PR #434"). It never looked at the diff — it failed while creating its model session:

Creating copilot-sdk session with model: claude-opus-5[ReasoningEffort=medium]
Error creating PR review request: SessionModelError: You have exceeded your monthly quota
  (Request ID: DC15:24052F:7A3978:8ACD38:6AB1BEF1)
  errorType: 'quota', statusCode: 402
##[error]Process completed with exit code 1.

HTTP 402, errorCode: "quota", against api.business.githubcopilot.com. That is an account-level GitHub Copilot quota, exhausted before any analysis began. It is not a finding, and no change to this branch can affect it — this PR's entire diff is one line of Markdown in CLAUDE.md, with no code, no build inputs and no workflow files touched. Any PR opened against this repo right now will fail the same check the same way until the quota resets or is raised.

I could not re-run it to confirm: rerun-failed-jobs returns 403 This workflow run cannot be retried, because this is a GitHub-managed dynamic workflow (dynamic/agents/github-advanced-security) rather than a workflow file in this repo. So the reproduction evidence here is the log above rather than a second run.

Nothing to fix and nothing to push. Clearing it needs the Copilot quota raised or reset on the account — an owner action, outside this PR. I'm leaving the PR watched and will keep re-checking until it's mergeable, rather than treating this as done.

---

Generated by Claude Code