readme: document --clean flag

README.md

@@ -18,6 +18,13 @@ For every binary cfgrip processes, it produces:
 - **Import table** — resolved library imports with addresses
 - **Indirect targets** — GOT-resolved calls, jump table entries, register-traced branches, and unresolved ones (marked as such)
 
+With `--clean`, it additionally:
+
+- **Jump-threads** `jmp` → `jmp` chains into direct edges
+- **Prunes** dead basic blocks (no incoming edges)
+- **Annotates** each instruction with `stack_offset` (RSP delta from function entry)
+- **Builds** an `xrefs` section mapping every call/jump target back to its callers
+
 It handles indirect branches by:
 1. Checking the **GOT** (Global Offset Table) for known imports
 2. Scanning backward for **LEA instructions** to locate jump tables, then reading table entries
@@ -26,11 +33,12 @@ It handles indirect branches by:
 ## usage
 
 ```
-cfgrip [--subs-only] <binary>
+cfgrip [--subs-only] [--clean] <binary>
 ```
 
 Feed it a binary, get `<binary>.cfg` as output.  
-Use `--subs-only` to extract only functions reachable from the entry point through the call graph — skips unreachable exports and prolog candidates.
+Use `--subs-only` to extract only functions reachable from the entry point through the call graph — skips unreachable exports and prolog candidates.  
+Use `--clean` to apply jump-threading, dead-block pruning, stack-offset tracking, and cross-reference analysis.
 
 ---
 Example:
@@ -417,5 +425,6 @@ cmake --build build --config Release
 | | `call` targets | YES |
 | | Prolog scanning (`push rbp`, CET `endbr64`) | YES |
 | **Subs-only mode** | `--subs-only` flag | YES |
+| **CFG cleaning** | `--clean` (jump-thread, dead-block prune, stack deltas, xrefs) | YES |