diff --git a/LICENSE.txt b/LICENSE.txt
index 6b44aff4be..ed8ad367db 100644
--- a/LICENSE.txt
+++ b/LICENSE.txt
@@ -208,3 +208,38 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
+
+
+CRoaring
+-------------------------------------------------------------------------------
+The CRoaring project is under a dual license (Apache/MIT).
+Users of the library may choose one or the other license.
+---
+
+MIT License
+
+Copyright 2016-2022 The CRoaring authors
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
diff --git a/include/phasar/ControlFlow/CallGraphBase.h b/include/phasar/ControlFlow/CallGraphBase.h
index 2d39581e3c..186ca426f2 100644
--- a/include/phasar/ControlFlow/CallGraphBase.h
+++ b/include/phasar/ControlFlow/CallGraphBase.h
@@ -15,6 +15,7 @@
 #include "phasar/Utils/Compressor.h"
 #include "phasar/Utils/GraphTraits.h"
 #include "phasar/Utils/IotaIterator.h"
+#include "phasar/Utils/Macros.h"
 #include "phasar/Utils/NonNullPtr.h"
 #include "phasar/Utils/TypeTraits.h"
 
@@ -147,13 +148,15 @@ template <typename CallGraphTy, typename DB> class ReverseCGGraph {
                                         typename CallGraphTy::f_t>;
 
   constexpr ReverseCGGraph(
-      NonNullPtr<const CallGraphTy> CGView, NonNullPtr<const DB> IRDB,
+      NonNullPtr<const CallGraphTy> CGView PSR_LIFETIMEBOUND,
+      NonNullPtr<const DB> IRDB PSR_LIFETIMEBOUND,
       Compressor<typename CallGraphTy::f_t, FunctionId> FC) noexcept
     requires(NeedsMapping)
       : CGView(CGView), IRDB(IRDB), FC(std::move(FC)) {}
 
-  constexpr ReverseCGGraph(NonNullPtr<const CallGraphTy> CGView,
-                           NonNullPtr<const DB> IRDB) noexcept
+  constexpr ReverseCGGraph(NonNullPtr<const CallGraphTy> CGView
+                               PSR_LIFETIMEBOUND,
+                           NonNullPtr<const DB> IRDB PSR_LIFETIMEBOUND) noexcept
       : CGView(CGView), IRDB(IRDB) {
     FC.reserve(CGView->getNumVertexFunctions());
     for (const auto &Fun : CGView->getAllVertexFunctions()) {
diff --git a/include/phasar/PhasarLLVM/Pointer.h b/include/phasar/PhasarLLVM/Pointer.h
index 336d28a97c..713572dfb8 100644
--- a/include/phasar/PhasarLLVM/Pointer.h
+++ b/include/phasar/PhasarLLVM/Pointer.h
@@ -17,6 +17,7 @@
 #include "phasar/PhasarLLVM/Pointer/LLVMAliasInfo.h"
 #include "phasar/PhasarLLVM/Pointer/LLVMAliasSet.h"
 #include "phasar/PhasarLLVM/Pointer/LLVMGlobalInitCache.h"
+#include "phasar/PhasarLLVM/Pointer/LLVMPointerSemantics.h"
 #include "phasar/PhasarLLVM/Pointer/LLVMPointsToInfo.h"
 #include "phasar/PhasarLLVM/Pointer/LLVMPointsToUtils.h"
 #include "phasar/PhasarLLVM/Pointer/LLVMUnionFindAA.h"
diff --git a/include/phasar/PhasarLLVM/Pointer/AndersenOTFAA.h b/include/phasar/PhasarLLVM/Pointer/AndersenOTFAA.h
index 8b718379de..055a0d7b07 100644
--- a/include/phasar/PhasarLLVM/Pointer/AndersenOTFAA.h
+++ b/include/phasar/PhasarLLVM/Pointer/AndersenOTFAA.h
@@ -14,6 +14,7 @@
 #include "phasar/PhasarLLVM/Pointer/LLVMUnionFindAA.h"
 #include "phasar/Pointer/RawAliasSet.h"
 #include "phasar/Pointer/UnionFindAA.h"
+#include "phasar/Utils/Macros.h"
 #include "phasar/Utils/MaybeUniquePtr.h"
 #include "phasar/Utils/NonNullPtr.h"
 #include "phasar/Utils/Soundness.h"
@@ -22,6 +23,10 @@
 
 #include "llvm/ADT/ArrayRef.h"
 
+#include <cstdint>
+#include <string>
+#include <vector>
+
 namespace llvm {
 class Function;
 } // namespace llvm
@@ -30,10 +35,54 @@ namespace psr {
 
 class LLVMProjectIRDB;
 
+/// Opt-in call-string context-sensitivity for \c AndersenOTFSolver.
+///
+/// The call-string k-limit is fixed at 1: a selected function gets one set of
+/// PAG nodes per call-site that reaches it.  Non-selected functions keep a
+/// single set of nodes shared by all callers, exactly as before.
+struct ContextSensitivityOptions {
+  enum class Mode : uint8_t {
+    Off,     ///< Root context only; identical to the insensitive solver.
+    Manual,  ///< Only functions matching \c AllowList.
+    Dynamic, ///< \c AllowList plus functions observed as precision-critical.
+    All,     ///< Every function, until \c MaxContextualNodes is reached.
+  };
+
+  Mode SelectionMode = Mode::Off;
+  /// Function-name globs (\c llvm::GlobPattern).  \c DenyList wins over
+  /// \c AllowList.
+  std::vector<std::string> AllowList{};
+  std::vector<std::string> DenyList{};
+  /// Hard cap on context-qualified PAG nodes.  Once reached, no function is
+  /// newly selected and no already-selected function gets a further context:
+  /// sound, just less precise.  This is the knob that bounds run time; solve
+  /// time grows super-linearly in the node count, so raising it is not a
+  /// proportional trade.
+  size_t MaxContextualNodes = 20'000;
+  /// Cap on distinct calling contexts per function; further call sites fall
+  /// back to the shared root context.  A selected function costs one clone of
+  /// its whole body per context, so without this a single hot function can
+  /// consume \c MaxContextualNodes on its own.
+  unsigned MaxContextsPerFunction = 32;
+  /// \c Mode::Dynamic only: functions with more LLVM instructions than this
+  /// are never selected.  Cloning a large body per context is expensive, and
+  /// large functions are rarely the point where callers merge.
+  unsigned MaxContextualFunctionSize = 256;
+  /// \c Mode::Dynamic only: tighter size limit for the weaker signal where
+  /// the merged parameters never leave the function body.  Off by default:
+  /// that signal's only payoff is formal-vs-formal aliasing inside the body,
+  /// which \c buildResult unions back together across contexts anyway.
+  unsigned MaxLocalMergeFunctionSize = 0;
+
+  [[nodiscard]] constexpr bool isOff() const noexcept {
+    return SelectionMode == Mode::Off;
+  }
+};
+
 /// Alias-analysis result for the Andersen-style OTF points-to analysis.
 ///
 /// Two values may-alias iff their points-to sets share at least one abstract
-/// object.  Satisfies \c UnionFindAAResult so it can be wrapped by
+/// object.  Satisfies \c RawAAResult so it can be wrapped by
 /// \c LLVMUnionFindAliasIterator.
 struct AndersenOTFResult {
   TypedVector<ValueId, RawAliasSet<ValueId>> AliasSets;
@@ -63,7 +112,7 @@ struct AndersenOTFResult {
   }
 };
 
-static_assert(UnionFindAAResult<AndersenOTFResult>);
+static_assert(RawAAResult<AndersenOTFResult>);
 
 /// Andersen-style inclusion-based points-to analysis that co-refines the call
 /// graph and points-to sets in a single fixpoint.
@@ -72,13 +121,16 @@ static_assert(UnionFindAAResult<AndersenOTFResult>);
 /// function-worklist loop: direct calls add callees immediately; indirect
 /// calls are resolved as \c pts(fp) grows.
 ///
-/// Phase 1: context- and field-insensitive.
+/// Context-sensitivity is opt-in via \c ContextSensitivityOptions and off by
+/// default.
 class AndersenOTFSolver {
 public:
-  explicit AndersenOTFSolver(const LLVMProjectIRDB &IRDB,
-                             llvm::ArrayRef<const llvm::Function *> Entries,
-                             ValueCompressor<PAGVariable> &VC,
-                             Soundness S = Soundness::Soundy) noexcept;
+  explicit AndersenOTFSolver(const LLVMProjectIRDB &IRDB PSR_LIFETIMEBOUND,
+                             llvm::ArrayRef<const llvm::Function *> Entries
+                                 PSR_LIFETIMEBOUND,
+                             ValueCompressor<PAGVariable> &VC PSR_LIFETIMEBOUND,
+                             Soundness S = Soundness::Soundy,
+                             ContextSensitivityOptions CSOpts = {}) noexcept;
 
   /// Run the full OTF fixpoint and return the alias-analysis result.
   [[nodiscard]] AndersenOTFResult solve();
@@ -90,6 +142,7 @@ class AndersenOTFSolver {
   llvm::ArrayRef<const llvm::Function *> Entries;
   NonNullPtr<ValueCompressor<PAGVariable>> VC;
   Soundness S;
+  ContextSensitivityOptions CSOpts;
 };
 
 // ---- Factory functions ------------------------------------------------
@@ -100,14 +153,16 @@ class AndersenOTFSolver {
 computeAndersenOTFRaw(const LLVMProjectIRDB &IRDB,
                       llvm::ArrayRef<const llvm::Function *> EntryPoints,
                       MaybeUniquePtr<ValueCompressor<PAGVariable>> VC = nullptr,
-                      Soundness S = Soundness::Soundy);
+                      Soundness S = Soundness::Soundy,
+                      ContextSensitivityOptions CSOpts = {});
 
 /// Runs the Andersen OTF fixpoint and returns an \c LLVMUnionFindAliasIterator
 /// that implements \c IsLLVMAliasIterator.
-[[nodiscard]] LLVMUnionFindAliasIterator<AndersenOTFResult>
+[[nodiscard]] LLVMRawAliasIterator<AndersenOTFResult>
 computeAndersenOTF(const LLVMProjectIRDB &IRDB,
                    llvm::ArrayRef<const llvm::Function *> EntryPoints,
                    MaybeUniquePtr<ValueCompressor<PAGVariable>> VC = nullptr,
-                   Soundness S = Soundness::Soundy);
+                   Soundness S = Soundness::Soundy,
+                   ContextSensitivityOptions CSOpts = {});
 
 } // namespace psr
diff --git a/include/phasar/PhasarLLVM/Pointer/LLVMPointerSemantics.h b/include/phasar/PhasarLLVM/Pointer/LLVMPointerSemantics.h
new file mode 100644
index 0000000000..67070c196d
--- /dev/null
+++ b/include/phasar/PhasarLLVM/Pointer/LLVMPointerSemantics.h
@@ -0,0 +1,170 @@
+#pragma once
+
+/******************************************************************************
+ * Copyright (c) 2026 Fabian Schiebel.
+ * All rights reserved. This program and the accompanying materials are made
+ * available under the terms of LICENSE.txt.
+ *
+ * Contributors:
+ *     Fabian Schiebel and others
+ *****************************************************************************/
+
+#include "phasar/PhasarLLVM/Utils/LLVMShorthands.h"
+#include "phasar/Utils/Utilities.h"
+
+#include "llvm/ADT/DenseMap.h"
+#include "llvm/ADT/STLExtras.h"
+#include "llvm/IR/DataLayout.h"
+#include "llvm/IR/DerivedTypes.h"
+#include "llvm/IR/Function.h"
+#include "llvm/IR/GlobalVariable.h"
+#include "llvm/IR/InstIterator.h"
+#include "llvm/IR/Instruction.h"
+#include "llvm/IR/Instructions.h"
+#include "llvm/IR/Type.h"
+#include "llvm/IR/Value.h"
+#include "llvm/Support/Casting.h"
+
+#include <optional>
+
+/// LLVM-level questions that LLVMPAGBuilder and AndersenOTFSolver must answer
+/// identically. They emit different node and edge kinds, but must not disagree
+/// on which IR constructs carry pointers.
+
+namespace psr {
+
+/// Whether a value of the pointer-free type \p Ty is laid out such that it
+/// could hold pointer bit patterns.
+[[nodiscard]] inline bool mayHidePointer(const llvm::DataLayout &DL,
+                                         const llvm::Type *Ty) {
+  if (Ty->isIntegerTy(DL.getPointerSizeInBits())) {
+    return true;
+  }
+  if (const auto *Arr = llvm::dyn_cast<llvm::ArrayType>(Ty)) {
+    return mayHidePointer(DL, Arr->getElementType());
+  }
+  const auto *Struct = llvm::dyn_cast<llvm::StructType>(Ty);
+  return Struct && !Struct->isOpaque() && !Struct->elements().empty() &&
+         llvm::all_of(Struct->elements(), [&DL](const llvm::Type *ElemTy) {
+           return mayHidePointer(DL, ElemTy);
+         });
+}
+
+/// Whether Ptr is a memory-location (alloca or global), accessed as an
+/// integer.
+///
+/// Useful for handling atomicrmw of pointers, which clang punns to i64, and
+/// for ABI-coerced aggregates (see PunnedABICache).
+[[nodiscard]] inline bool isPunnedPointerAccess(const llvm::DataLayout &DL,
+                                                const llvm::Value *Ptr,
+                                                const llvm::Type *AccessedTy) {
+  if (!mayHidePointer(DL, AccessedTy)) {
+    return false;
+  }
+  const llvm::Value *Base = Ptr->stripPointerCastsAndAliases();
+  if (const auto *A = llvm::dyn_cast<llvm::AllocaInst>(Base)) {
+    return !definitelyContainsNoPointer(A->getAllocatedType());
+  }
+  if (const auto *G = llvm::dyn_cast<llvm::GlobalVariable>(Base)) {
+    return !definitelyContainsNoPointer(G->getValueType());
+  }
+  return false;
+}
+
+/// The memory access to model for a load, store, atomicrmw or cmpxchg.
+struct LLVMMemoryAccess {
+  const llvm::Instruction *Instr{};
+  const llvm::Value *Pointer{};
+  /// Null if the access only reads.
+  const llvm::Value *StoredValue{};
+  /// Null if the access only writes; \c Instr itself for an atomic.
+  const llvm::Instruction *LoadedInto{};
+  bool Punned{};
+
+  /// The value whose type decides whether a pointer is transferred. For a
+  /// cmpxchg that is the new value, not the { ty, i1 } result.
+  [[nodiscard]] const llvm::Value *transferredValue() const noexcept {
+    return StoredValue ? StoredValue : LoadedInto;
+  }
+
+  /// Whether the access has to be modeled at all. Gating on
+  /// definitelyContainsNoPointer alone would drop punned accesses.
+  [[nodiscard]] bool mayTransferPointer() const {
+    return Punned || !definitelyContainsNoPointer(transferredValue());
+  }
+};
+
+/// Decomposes \p I, or returns nullopt if it is not a memory access. Field-
+/// insensitively an atomicrmw is a store of the new value plus a load of the
+/// old one; cmpxchg likewise, into its { ty, i1 } result.
+///
+/// The result still has to pass mayTransferPointer().
+[[nodiscard]] inline std::optional<LLVMMemoryAccess>
+asMemoryAccess(const llvm::Instruction &I, const llvm::DataLayout &DL) {
+  const auto Make = [&DL, &I](const llvm::Value *Ptr,
+                              const llvm::Value *StoredValue,
+                              const llvm::Instruction *LoadedInto) {
+    const auto *Transferred = StoredValue ? StoredValue : LoadedInto;
+    return LLVMMemoryAccess{
+        .Instr = &I,
+        .Pointer = Ptr,
+        .StoredValue = StoredValue,
+        .LoadedInto = LoadedInto,
+        .Punned = isPunnedPointerAccess(DL, Ptr, Transferred->getType()),
+    };
+  };
+
+  if (const auto *S = llvm::dyn_cast<llvm::StoreInst>(&I)) {
+    return Make(S->getPointerOperand(), S->getValueOperand(), nullptr);
+  }
+  if (const auto *L = llvm::dyn_cast<llvm::LoadInst>(&I)) {
+    return Make(L->getPointerOperand(), nullptr, L);
+  }
+  if (const auto *RMW = llvm::dyn_cast<llvm::AtomicRMWInst>(&I)) {
+    return Make(RMW->getPointerOperand(), RMW->getValOperand(), RMW);
+  }
+  if (const auto *CX = llvm::dyn_cast<llvm::AtomicCmpXchgInst>(&I)) {
+    return Make(CX->getPointerOperand(), CX->getNewValOperand(), CX);
+  }
+  return std::nullopt;
+}
+
+/// Recognizes ABI-coerced boundary values: values that carry a pointer
+/// although their type has none.
+///
+/// A small pointer-carrying struct is passed and returned in registers:
+///
+/// For whatever reason, on AArch64 clang punns such nested pointers as i64
+/// instead of ptr. This here is a best-effort approcach to keep pointer
+/// data-flows in such situations.
+class PunnedABICache {
+public:
+  explicit PunnedABICache(const llvm::DataLayout *DL) noexcept
+      : DL(&assertNotNull(DL)) {}
+
+  /// Whether \p V -- an argument, returned value or call result of \p F --
+  /// carries a pointer that its type does not reveal.
+  [[nodiscard]] bool isCoercedPointer(const llvm::Value *V,
+                                      const llvm::Function *F) {
+    return !llvm::isa<llvm::ConstantData>(V) &&
+           definitelyContainsNoPointer(V->getType()) &&
+           mayHidePointer(*DL, V->getType()) && punsPointers(F);
+  }
+
+private:
+  bool punsPointers(const llvm::Function *F) {
+    auto [It, Inserted] = Cache.try_emplace(F, false);
+    if (Inserted) {
+      It->second = llvm::any_of(llvm::instructions(*F), [this](const auto &I) {
+        const auto Access = asMemoryAccess(I, *DL);
+        return Access && Access->Punned;
+      });
+    }
+    return It->second;
+  }
+
+  const llvm::DataLayout *DL;
+  llvm::DenseMap<const llvm::Function *, bool> Cache;
+};
+
+} // namespace psr
diff --git a/include/phasar/PhasarLLVM/Pointer/LLVMRawAAResults.h b/include/phasar/PhasarLLVM/Pointer/LLVMRawAAResults.h
new file mode 100644
index 0000000000..4a436ad382
--- /dev/null
+++ b/include/phasar/PhasarLLVM/Pointer/LLVMRawAAResults.h
@@ -0,0 +1,300 @@
+#pragma once
+
+/******************************************************************************
+ * Copyright (c) 2026 Fabian Schiebel.
+ * All rights reserved. This program and the accompanying materials are made
+ * available under the terms of LICENSE.txt.
+ *
+ * Contributors:
+ *     Fabian Schiebel and others
+ *****************************************************************************/
+
+#include "phasar/PhasarLLVM/Pointer/LLVMPointerAssignmentGraph.h"
+#include "phasar/PhasarLLVM/Utils/LLVMShorthands.h"
+#include "phasar/Pointer/AliasResult.h"
+#include "phasar/Pointer/RawAAResult.h"
+#include "phasar/Utils/NonNullPtr.h"
+
+#include "llvm/IR/Instructions.h"
+
+namespace psr {
+
+/// Returns a \c ValueId handler suitable for \c RawAliasSet::foreach() that
+/// maps each alias \c ValueId back to all of its underlying \c llvm::Value*
+/// (via \p VC), forwarding non-null values to \p Callback.
+constexpr std::invocable<ValueId> auto
+llvmRawAliasHandler(const ValueCompressor<PAGVariable> &VC,
+                    std::invocable<const llvm::Value *> auto Callback) {
+  return [&VC, Callback{copyOrRef(Callback)}](ValueId Alias) {
+    for (auto V : VC.id2vars(Alias)) {
+      if (const auto *LLVMVar = V.valueOrNull()) [[likely]] {
+        std::invoke(Callback, LLVMVar);
+      }
+    }
+  };
+}
+
+/// CRTP mixin that adds the LLVM alias-iterator interface to a class that
+/// holds a \c RawAAResult and a \c ValueCompressor<PAGVariable>.
+///
+/// Provides \c forallAliasesOf(), \c mayAlias(), and \c alias() overloads
+/// accepting both \c llvm::Value* and \c ValueId arguments.  Results are
+/// reported as \c llvm::Value* via the stored \c ValueCompressor.
+///
+/// The derived class must expose a \c VC member (pointer to a
+/// \c ValueCompressor<PAGVariable>).
+///
+/// \tparam Derived The CRTP derived class.
+/// \tparam AAResT  A type satisfying \c RawAAResult.
+template <typename Derived, typename AAResT>
+  requires RawAAResult<std::remove_cvref_t<AAResT>>
+// NOLINTNEXTLINE(cppcoreguidelines-pro-type-member-init)
+struct LLVMRawAliasIteratorMixin {
+  [[no_unique_address]] AAResT AARes;
+
+  using v_t = const llvm::Value *;
+  using n_t = const llvm::Instruction *;
+
+  [[nodiscard]] decltype(auto) getRawAliasSet(ValueId ValId) const {
+    return AARes.getRawAliasSet(ValId);
+  }
+
+  [[nodiscard]] const auto &base() const noexcept { return AARes; }
+
+  void
+  forallAliasesOf(ValueId VId, const auto & /*Inst*/,
+                  std::invocable<const llvm::Value *> auto Callback) const {
+    const auto &RawAliases = AARes.getRawAliasSet(VId);
+    RawAliases.foreach (llvmRawAliasHandler(*self().VC, copyOrRef(Callback)));
+  }
+
+  void
+  forallAliasesOf(const llvm::Value *Ptr, const auto &Inst,
+                  std::invocable<const llvm::Value *> auto Callback) const {
+    if (auto ValId = self().VC->getOrNull(Ptr)) {
+      forallAliasesOf(*ValId, Inst, copyOrRef(Callback));
+    }
+  }
+
+  [[nodiscard]] bool mayAlias(ValueId Ptr1, ValueId Ptr2) const {
+    return AARes.mayAlias(Ptr1, Ptr2);
+  }
+
+  [[nodiscard]] bool mayAlias(ValueId Ptr1, ValueId Ptr2,
+                              const auto & /*AtInstruction*/) const {
+    return AARes.mayAlias(Ptr1, Ptr2);
+  }
+
+  [[nodiscard]] bool mayAlias(const llvm::Value *Ptr1,
+                              const llvm::Value *Ptr2) const {
+    auto ValId1 = self().VC->getOrNull(Ptr1);
+    auto ValId2 = self().VC->getOrNull(Ptr2);
+
+    return ValId1 && ValId2 && mayAlias(*ValId1, *ValId2);
+  }
+
+  [[nodiscard]] bool mayAlias(const llvm::Value *Ptr1, const llvm::Value *Ptr2,
+                              const auto & /*AtInstruction*/) const {
+    return mayAlias(Ptr1, Ptr2);
+  }
+
+  [[nodiscard]] AliasResult alias(const llvm::Value *Ptr1,
+                                  const llvm::Value *Ptr2,
+                                  const auto &AtInstruction) const {
+    auto ValId1 = self().VC->getOrNull(Ptr1);
+    auto ValId2 = self().VC->getOrNull(Ptr2);
+    if (!ValId1 || !ValId2) {
+      return AliasResult::NoAlias;
+    }
+    if (*ValId1 == *ValId2) {
+      if (Ptr1 == Ptr2) {
+        return AliasResult::MustAlias;
+      }
+      return !llvm::isa<llvm::LoadInst>(Ptr1) &&
+                     !llvm::isa<llvm::LoadInst>(Ptr2)
+                 ? AliasResult::MustAlias
+                 : AliasResult::MayAlias;
+    }
+    return mayAlias(*ValId1, *ValId2, AtInstruction) ? AliasResult::MayAlias
+                                                     : AliasResult::NoAlias;
+  }
+
+  [[nodiscard]] constexpr const Derived &self() const noexcept {
+    return *static_cast<const Derived *>(this);
+  }
+};
+
+template <typename AAResT>
+  requires RawAAResult<std::remove_cvref_t<AAResT>>
+// NOLINTNEXTLINE(cppcoreguidelines-pro-type-member-init)
+struct LLVMRawAliasIterator
+    : public LLVMRawAliasIteratorMixin<LLVMRawAliasIterator<AAResT>, AAResT> {
+  MaybeUniquePtr<const ValueCompressor<PAGVariable>> VC;
+
+  constexpr LLVMRawAliasIterator(
+      AAResT &&AARes,
+      MaybeUniquePtr<const ValueCompressor<PAGVariable>> VC PSR_LIFETIMEBOUND)
+      : psr::LLVMRawAliasIteratorMixin<LLVMRawAliasIterator<AAResT>,
+                                       AAResT>{PSR_FWD(AARes)},
+        VC(std::move(VC)) {}
+};
+
+template <typename AAResT>
+LLVMRawAliasIterator(AAResT, MaybeUniquePtr<const ValueCompressor<PAGVariable>>)
+    -> LLVMRawAliasIterator<AAResT>;
+template <typename AAResT>
+LLVMRawAliasIterator(AAResT, const ValueCompressor<PAGVariable> *)
+    -> LLVMRawAliasIterator<AAResT>;
+
+namespace detail {
+class LLVMLocalRawAliasIteratorBase {
+public:
+  explicit LLVMLocalRawAliasIteratorBase(
+      const ValueCompressor<PAGVariable> &VC);
+
+protected:
+  llvm::DenseMap<const llvm::Function *, RawAliasSet<ValueId>> GlobalsOrInFun;
+};
+} // namespace detail
+
+/// CRTP mixin adding a function-local view on top of a global
+/// \c RawAAResult.
+///
+/// Extends \c LLVMRawAliasIteratorMixin with \c forallAliasesOf()
+/// overloads that accept an \c llvm::Function* or \c llvm::Instruction*
+/// context.  When a non-null context is provided, alias sets are intersected
+/// with the set of variables that are visible in that function (globals plus
+/// locals defined in that function), giving a function-local result even
+/// though the underlying analysis is interprocedural.
+template <typename Derived, typename AAResT>
+class LLVMLocalRawAliasIteratorMixin
+    : public detail::LLVMLocalRawAliasIteratorBase {
+public:
+  LLVMLocalRawAliasIteratorMixin(AAResT &&AARes,
+                                 const ValueCompressor<PAGVariable> &VC)
+      : detail::LLVMLocalRawAliasIteratorBase(VC), AARes(PSR_FWD(AARes)) {}
+
+  [[nodiscard]] decltype(auto) getRawAliasSet(ValueId ValId) const {
+    return AARes.getRawAliasSet(ValId);
+  }
+
+  [[nodiscard]] auto getRawAliasSet(ValueId ValId,
+                                    const llvm::Function *Context) const {
+    auto Vars = AARes.getRawAliasSet(ValId);
+    if (Context) {
+      Vars &= getOrDefault(GlobalsOrInFun, Context);
+    }
+    return Vars;
+  }
+
+  [[nodiscard]] const auto &base() const noexcept { return AARes; }
+
+  [[nodiscard]] auto getRawAliasSet(ValueId ValId,
+                                    const llvm::Instruction *Context) const {
+    return getRawAliasSet(ValId, getFunction(Context));
+  }
+
+  void forallAliasesOf(ValueId VId, const llvm::Function *Context,
+                       std::invocable<const llvm::Value *> auto WithAlias) {
+    const auto AliasHandler =
+        llvmRawAliasHandler(*self().VC, copyOrRef(WithAlias));
+
+    auto &&RawVars = AARes.getRawAliasSet(VId);
+    if (Context) {
+      auto Vars = PSR_FWD(RawVars);
+      Vars &= getOrDefault(GlobalsOrInFun, Context);
+      Vars.foreach (AliasHandler);
+    } else {
+      RawVars.foreach (AliasHandler);
+    }
+  }
+
+  void forallAliasesOf(const llvm::Value *Val, const llvm::Function *Context,
+                       std::invocable<const llvm::Value *> auto WithAlias) {
+    if (auto ValId = self().VC->getOrNull(Val)) {
+      forallAliasesOf(*ValId, Context, copyOrRef(WithAlias));
+    }
+  }
+
+  void forallAliasesOf(ValueId ValId, const llvm::Instruction *AtInstruction,
+                       std::invocable<const llvm::Value *> auto WithAlias) {
+    forallAliasesOf(ValId, psr::getFunction(AtInstruction),
+                    copyOrRef(WithAlias));
+  }
+
+  void forallAliasesOf(const llvm::Value *Val,
+                       const llvm::Instruction *AtInstruction,
+                       std::invocable<const llvm::Value *> auto WithAlias) {
+    forallAliasesOf(Val, psr::getFunction(AtInstruction), copyOrRef(WithAlias));
+  }
+
+  void forallAliasesOf(const llvm::Value *Val,
+                       std::invocable<const llvm::Value *> auto WithAlias) {
+    forallAliasesOf(Val, psr::getFunction(Val), copyOrRef(WithAlias));
+  }
+
+  [[nodiscard]] bool
+  mayAlias(ValueId ValId1, ValueId ValId2,
+           const llvm::Instruction * /*AtInstruction*/ = nullptr) const {
+    // XXX: Should we filter by AtInstruction-context here as well?
+    return AARes.mayAlias(ValId1, ValId2);
+  }
+
+  [[nodiscard]] bool
+  mayAlias(const llvm::Value *Ptr1, const llvm::Value *Ptr2,
+           const llvm::Instruction * /*AtInstruction*/ = nullptr) const {
+    auto ValId1 = self().VC->getOrNull(Ptr1);
+    auto ValId2 = self().VC->getOrNull(Ptr2);
+
+    // XXX: Should we filter by AtInstruction-context here as well?
+    return ValId1 && ValId2 && AARes.mayAlias(*ValId1, *ValId2);
+  }
+
+  [[nodiscard]] AliasResult alias(const llvm::Value *Ptr1,
+                                  const llvm::Value *Ptr2,
+                                  const auto &AtInstruction) const {
+    auto ValId1 = self().VC->getOrNull(Ptr1);
+    auto ValId2 = self().VC->getOrNull(Ptr2);
+    if (!ValId1 || !ValId2) {
+      return AliasResult::NoAlias;
+    }
+    if (*ValId1 == *ValId2) {
+      if (Ptr1 == Ptr2) {
+        return AliasResult::MustAlias;
+      }
+      return !llvm::isa<llvm::LoadInst>(Ptr1) &&
+                     !llvm::isa<llvm::LoadInst>(Ptr2)
+                 ? AliasResult::MustAlias
+                 : AliasResult::MayAlias;
+    }
+    return mayAlias(*ValId1, *ValId2, AtInstruction) ? AliasResult::MayAlias
+                                                     : AliasResult::NoAlias;
+  }
+
+  [[nodiscard]] constexpr const Derived &self() const noexcept {
+    return *static_cast<const Derived *>(this);
+  }
+
+private:
+  AAResT AARes;
+};
+
+template <typename AAResT>
+class LLVMLocalRawAliasIterator
+    : public LLVMLocalRawAliasIteratorMixin<LLVMLocalRawAliasIterator<AAResT>,
+                                            AAResT> {
+  friend LLVMLocalRawAliasIteratorMixin<LLVMLocalRawAliasIterator<AAResT>,
+                                        AAResT>;
+
+public:
+  LLVMLocalRawAliasIterator(AAResT &&AARes,
+                            NonNullPtr<const ValueCompressor<PAGVariable>> VC
+                                PSR_LIFETIMEBOUND)
+      : LLVMLocalRawAliasIteratorMixin<LLVMLocalRawAliasIterator<AAResT>,
+                                       AAResT>(PSR_FWD(AARes), *VC),
+        VC(VC) {}
+
+private:
+  NonNullPtr<const ValueCompressor<PAGVariable>> VC;
+};
+} // namespace psr
diff --git a/include/phasar/PhasarLLVM/Pointer/LLVMRawAliasSet.h b/include/phasar/PhasarLLVM/Pointer/LLVMRawAliasSet.h
new file mode 100644
index 0000000000..6760a74768
--- /dev/null
+++ b/include/phasar/PhasarLLVM/Pointer/LLVMRawAliasSet.h
@@ -0,0 +1,350 @@
+#pragma once
+
+/******************************************************************************
+ * Copyright (c) 2026 Fabian Schiebel.
+ * All rights reserved. This program and the accompanying materials are made
+ * available under the terms of LICENSE.txt.
+ *
+ * Contributors:
+ *     Fabian Schiebel and others
+ *****************************************************************************/
+
+#include "phasar/PhasarLLVM/ControlFlow/LLVMBasedCallGraph.h"
+#include "phasar/PhasarLLVM/Pointer/LLVMAliasSet.h"
+#include "phasar/PhasarLLVM/Pointer/LLVMPointerAssignmentGraph.h"
+#include "phasar/PhasarLLVM/Pointer/LLVMPointsToUtils.h"
+#include "phasar/PhasarLLVM/Pointer/LLVMRawAAResults.h"
+#include "phasar/PhasarLLVM/Utils/LLVMShorthands.h"
+#include "phasar/Pointer/AliasAnalysisType.h"
+#include "phasar/Pointer/AliasInfoTraits.h"
+#include "phasar/Pointer/AliasResult.h"
+#include "phasar/Pointer/AliasSetOwner.h"
+#include "phasar/Pointer/RawAAResult.h"
+#include "phasar/Pointer/RawAliasSet.h"
+#include "phasar/Pointer/UnionFindAliasAnalysisType.h"
+#include "phasar/Utils/AnalysisProperties.h"
+#include "phasar/Utils/Macros.h"
+#include "phasar/Utils/TypedVector.h"
+#include "phasar/Utils/ValueCompressor.h"
+
+#include "llvm/IR/Instructions.h"
+#include "llvm/Support/TypeName.h"
+
+#include <memory>
+#include <type_traits>
+
+namespace llvm {
+class Value;
+class Instruction;
+class Function;
+} // namespace llvm
+
+namespace psr {
+
+class LLVMRawAliasSet;
+class LLVMProjectIRDB;
+
+template <>
+struct AliasInfoTraits<LLVMRawAliasSet>
+    : DefaultAATraits<const llvm::Value *, const llvm::Instruction *> {};
+
+struct LLVMRawAliasSetBase {
+  using traits_t = AliasInfoTraits<LLVMRawAliasSet>;
+  using n_t = traits_t::n_t;
+  using v_t = traits_t::v_t;
+  using AliasSetTy = traits_t::AliasSetTy;
+  using AliasSetPtrTy = traits_t::AliasSetPtrTy;
+  using AllocationSiteSetPtrTy = traits_t::AllocationSiteSetPtrTy;
+
+  /// Whether alias sets are reported globally or filtered to the function
+  /// containing the query instruction.
+  enum class AnalysisLocality : uint8_t {
+    /// All aliases across all functions are reported.
+    Global,
+    /// Aliases are intersected with variables visible in the querying function
+    /// (globals + function-local values).
+    FunctionLocal,
+  };
+
+  struct Config {
+    /// The specific union-find analysis variant to run (default:
+    /// \c BotCtxIndSens — bottom-up, context- and indirection-sensitive).
+    UnionFindAliasAnalysisType AType =
+        UnionFindAliasAnalysisType::BotCtxIndSens;
+    /// Controls whether alias sets are scoped to the querying function.
+    AnalysisLocality ALocality = AnalysisLocality::Global;
+  };
+};
+
+[[nodiscard]] llvm::StringRef
+to_string(LLVMRawAliasSetBase::AnalysisLocality ALoc) noexcept;
+
+/// Concrete \c IsAliasInfo implementation backed by a raw alias
+/// analysis. Provides convenience constructors to invoke union-find-based
+/// analyses, but can be instantiated with *any* analysis result that conforms
+/// to \c RawAAResult .
+///
+/// Alias sets are materialized lazily on first query and cached per \c ValueId
+/// in \c AliasSets.
+///
+/// \note When \c AnalysisLocality::FunctionLocal is selected, alias sets are
+///   filtered to variables visible in the function that contains the query
+///   instruction.  The per-\c ValueId cache does **not** account for the
+///   instruction context, so the first caller's function wins — do not mix
+///   queries to local pointers from different functions for the same value in
+///   local mode.
+class LLVMRawAliasSet : public LLVMRawAliasSetBase,
+                        public AnalysisPropertiesMixin<LLVMRawAliasSet> {
+public:
+  explicit LLVMRawAliasSet(const LLVMProjectIRDB *IRDB,
+                           const LLVMBasedCallGraph &BaseCG, Config Cfg,
+                           ValueCompressor<PAGVariable> *VC);
+  explicit LLVMRawAliasSet(const LLVMProjectIRDB *IRDB,
+                           const LLVMBasedCallGraph &BaseCG, Config Cfg)
+      : LLVMRawAliasSet(IRDB, BaseCG, Cfg, nullptr) {}
+  explicit LLVMRawAliasSet(const LLVMProjectIRDB *IRDB,
+                           const LLVMBasedCallGraph &BaseCG)
+      : LLVMRawAliasSet(IRDB, BaseCG, Config{}, nullptr) {}
+
+  template <RawAAResult AAResT>
+  explicit LLVMRawAliasSet(AAResT &&AARes,
+                           MaybeUniquePtr<ValueCompressor<PAGVariable>> VC,
+                           AnalysisProperties Props = {})
+      : Props(Props) {
+    assert(VC != nullptr);
+    AliasSets.resize(VC->size());
+    // XXX: Support locality
+
+    this->AARes = std::make_unique<
+        AAResultModel<LLVMRawAliasIteratorMixin, std::remove_cvref_t<AAResT>>>(
+        std::move(VC), PSR_FWD(AARes));
+  }
+
+  [[nodiscard]] constexpr std::true_type isInterProcedural() const noexcept {
+    return {};
+  };
+
+  [[nodiscard]] constexpr std::integral_constant<AliasAnalysisType,
+                                                 AliasAnalysisType::UnionFind>
+  getAliasAnalysisType() const noexcept {
+    return {};
+  };
+
+  [[nodiscard]] constexpr AnalysisProperties
+  getAnalysisProperties() const noexcept {
+    return Props;
+  }
+
+  [[nodiscard]] constexpr AliasResult alias(v_t V1, v_t V2, n_t I) const {
+    assert(isValid());
+    return AARes->alias(V1, V2, I);
+  }
+
+  void foreachAliasOf(v_t V, n_t I,
+                      llvm::function_ref<void(v_t)> WithAlias) const {
+    assert(isValid());
+    AARes->forallAliasesOf(V, I, WithAlias);
+  }
+
+  [[nodiscard]] AliasSetPtrTy getAliasSet(v_t V, n_t I) {
+    assert(isValid());
+    auto ValId = AARes->VC->getOrNull(V);
+    if (!ValId) {
+      return getEmptyAliasSet();
+    }
+
+    assert(AliasSets.inbounds(*ValId));
+    if (!AliasSets[*ValId]) [[unlikely]] {
+      AliasSets[*ValId] = AARes->constructAliasSet(*ValId, I, Owner);
+    }
+
+    return AliasSets[*ValId];
+  }
+
+  [[nodiscard]] AllocationSiteSetPtrTy
+  getReachableAllocationSites(v_t V, bool IntraProcOnly, n_t I) const {
+    assert(isValid());
+    auto ValId = AARes->VC->getOrNull(V);
+    if (!ValId) {
+      return std::make_unique<AliasSetTy>();
+    }
+
+    return AARes->constructReachableAllocSites(V, *ValId, IntraProcOnly, I);
+  }
+
+  [[nodiscard]] bool isInReachableAllocationSites(
+      const llvm::Value *V, const llvm::Value *PotentialValue,
+      bool IntraProcOnly, const llvm::Instruction *I) const {
+    assert(isValid());
+    if (!psr::isInterestingPointer(V)) {
+      return false;
+    }
+
+    if (!psr::isInReachableAllocationSitesTy(V, PotentialValue,
+                                             IntraProcOnly)) {
+      return false;
+    }
+
+    return alias(V, PotentialValue, I) != AliasResult::NoAlias;
+  }
+
+  void print(llvm::raw_ostream &OS) const;
+  void printAsJson(llvm::raw_ostream &OS) const;
+
+  [[nodiscard]] bool isValid() const noexcept {
+    return AARes != nullptr && AARes->VC != nullptr &&
+           AARes->VC->size() == AliasSets.size();
+  }
+
+private:
+  struct AAResultConcept {
+    MaybeUniquePtr<const ValueCompressor<PAGVariable>> VC;
+    std::optional<RawAliasSet<ValueId>> AllocationSites{};
+
+    AAResultConcept(
+        MaybeUniquePtr<const ValueCompressor<PAGVariable>> VC) noexcept
+        : VC(std::move(VC)) {}
+    virtual ~AAResultConcept() = default;
+
+    virtual void forallAliasesOf(v_t Ptr, n_t Inst,
+                                 llvm::function_ref<void(v_t)> Callback) = 0;
+
+    virtual AliasResult alias(v_t Ptr1, v_t Ptr2, n_t AtInstruction) = 0;
+
+    virtual AliasSetPtrTy
+    constructAliasSet(ValueId ValId, n_t Inst,
+                      AliasSetOwner<AliasSetTy> &Owner) = 0;
+
+    virtual AllocationSiteSetPtrTy
+    constructReachableAllocSites(v_t V, ValueId ValId, bool IntraProcOnly,
+                                 n_t Inst) = 0;
+
+    virtual void print(llvm::raw_ostream &OS, Config Cfg) const = 0;
+  };
+
+  static bool isPotentialAllocSite(const llvm::Value *Val) {
+    if (!Val->getType()->isPointerTy()) {
+      return false;
+    }
+    if (llvm::isa<llvm::AllocaInst, llvm::Argument>(Val)) {
+      return true;
+    }
+    if (const auto *Call = llvm::dyn_cast<llvm::CallBase>(Val)) {
+      return Call->getCalledFunction() &&
+             psr::isHeapAllocatingFunction(Call->getCalledFunction());
+    }
+    return false;
+  }
+
+  template <template <typename, typename> typename AAResIterT, typename AAResT>
+  struct AAResultModel
+      : public AAResultConcept,
+        public AAResIterT<AAResultModel<AAResIterT, AAResT>, AAResT> {
+
+    using base_t = AAResIterT<AAResultModel<AAResIterT, AAResT>, AAResT>;
+
+    template <typename... ArgsT>
+    constexpr AAResultModel(
+        MaybeUniquePtr<const ValueCompressor<PAGVariable>> VC, ArgsT &&...Args)
+        : AAResultConcept{std::move(VC)}, base_t{PSR_FWD(Args)...} {}
+
+    void forallAliasesOf(v_t Ptr, n_t Inst,
+                         llvm::function_ref<void(v_t)> Callback) override {
+      this->base_t::forallAliasesOf(Ptr, Inst, Callback);
+    }
+
+    AliasResult alias(v_t Ptr1, v_t Ptr2,
+                      n_t AtInstruction = nullptr) override {
+      return this->base_t::alias(Ptr1, Ptr2, AtInstruction);
+    }
+
+    AliasSetPtrTy constructAliasSet(ValueId ValId, n_t Inst,
+                                    AliasSetOwner<AliasSetTy> &Owner) override {
+      auto ASet = Owner.acquire();
+      try {
+        this->base_t::forallAliasesOf(
+            ValId, Inst,
+            [ASet{ASet.get()}](v_t Alias) -> void { ASet->insert(Alias); });
+        return ASet;
+      } catch (...) {
+        Owner.release(ASet.get());
+        throw;
+      }
+    }
+
+    AllocationSiteSetPtrTy constructReachableAllocSites(v_t V, ValueId ValId,
+                                                        bool IntraProcOnly,
+                                                        n_t Inst) override {
+      if (!this->AllocationSites) [[unlikely]] {
+        this->AllocationSites.emplace();
+        for (const auto &[VId, Vars] : this->VC->id2vars().enumerate()) {
+          for (const PAGVariable &Var : Vars) {
+            if (const auto *LLVMVar = Var.valueOrNull();
+                LLVMVar && isPotentialAllocSite(LLVMVar)) {
+              this->AllocationSites->insert(VId);
+              break;
+            }
+          }
+        }
+      }
+
+      auto RawAliases = [&]() -> RawAliasSet<ValueId> {
+        if constexpr (requires() {
+                        this->base_t::getRawAliasSet(ValId, Inst);
+                      }) {
+          return this->base_t::getRawAliasSet(ValId, Inst);
+        } else {
+          return this->base_t::getRawAliasSet(ValId);
+        }
+      }();
+      RawAliases &= *this->AllocationSites;
+
+      auto Ret = std::make_unique<AliasSetTy>();
+
+      RawAliases.foreach (
+          llvmRawAliasHandler(*this->VC, [&Ret, V, IntraProcOnly](v_t Alias) {
+            if (psr::isInReachableAllocationSitesTy(V, Alias, IntraProcOnly)) {
+              Ret->insert(Alias);
+            }
+          }));
+
+      return Ret;
+    }
+
+    void print(llvm::raw_ostream &OS, Config Cfg) const override {
+      OS << "LLVMRawAliasSet(" << to_string(Cfg.ALocality) << ", "
+         << llvm::getTypeName<AAResT>() << ") {\n";
+
+      for (auto ValId : iota<ValueId>(VC->size())) {
+        OS << "  #" << psr::to_underlying(ValId) << ": {";
+        bool First = true;
+        const auto &Aliases = this->base_t::getRawAliasSet(ValId);
+        Aliases.foreach ([&](auto AliasId) {
+          if (First) {
+            First = false;
+          } else {
+            OS << ", ";
+          }
+
+          OS << psr::to_underlying(AliasId);
+        });
+        OS << "}\n";
+      }
+      OS << "}\n";
+    };
+  };
+
+  [[nodiscard]] static BoxedPtr<AliasSetTy> getEmptyAliasSet();
+
+  // --- data members:
+
+  std::unique_ptr<AAResultConcept> AARes{};
+  AnalysisProperties Props{};
+  Config Cfg{};
+
+  AliasSetOwner<AliasSetTy>::memory_resource_type MRes{};
+  AliasSetOwner<AliasSetTy> Owner{&MRes};
+  TypedVector<ValueId, AliasSetPtrTy> AliasSets;
+};
+
+} // namespace psr
diff --git a/include/phasar/PhasarLLVM/Pointer/LLVMUnionFindAA.h b/include/phasar/PhasarLLVM/Pointer/LLVMUnionFindAA.h
index 049942543c..5f330dc606 100644
--- a/include/phasar/PhasarLLVM/Pointer/LLVMUnionFindAA.h
+++ b/include/phasar/PhasarLLVM/Pointer/LLVMUnionFindAA.h
@@ -12,50 +12,40 @@
 #include "phasar/PhasarLLVM/ControlFlow/LLVMBasedCallGraph.h"
 #include "phasar/PhasarLLVM/Pointer/LLVMAliasInfo.h"
 #include "phasar/PhasarLLVM/Pointer/LLVMPointerAssignmentGraph.h"
+#include "phasar/PhasarLLVM/Pointer/LLVMRawAAResults.h"
 #include "phasar/PhasarLLVM/Utils/LLVMShorthands.h"
-#include "phasar/Pointer/AliasResult.h"
 #include "phasar/Pointer/BottomupUnionFindAA.h"
-#include "phasar/Pointer/RawAliasSet.h"
 #include "phasar/Pointer/UnionFindAA.h"
 #include "phasar/Utils/Macros.h"
-#include "phasar/Utils/MapUtils.h"
 #include "phasar/Utils/MaybeUniquePtr.h"
 #include "phasar/Utils/NonNullPtr.h"
 #include "phasar/Utils/Utilities.h"
 #include "phasar/Utils/ValueCompressor.h"
 
 #include "llvm/IR/Instructions.h"
-#include "llvm/Support/Casting.h"
 
 #include <memory>
-#include <type_traits>
 
 namespace psr {
 extern template class CallingContextSensUnionFindAA<LLVMPAGDomain>;
 extern template class IndirectionSensUnionFindAA<LLVMPAGDomain>;
 extern template class BottomupUnionFindAA<LLVMPAGDomain>;
 
-/// Returns a \c ValueId handler suitable for \c RawAliasSet::foreach() that
-/// maps each alias \c ValueId back to all of its underlying \c llvm::Value*
-/// (via \p VC), forwarding non-null values to \p Callback.
-constexpr std::invocable<ValueId> auto
-llvmUnionFindAliasHandler(const ValueCompressor<PAGVariable> &VC,
-                          std::invocable<const llvm::Value *> auto Callback) {
-  return [&VC, Callback{copyOrRef(Callback)}](ValueId Alias) {
-    for (auto V : VC.id2vars(Alias)) {
-      if (const auto *LLVMVar = V.valueOrNull()) [[likely]] {
-        std::invoke(Callback, LLVMVar);
-      }
-    }
-  };
-}
+/// For backwards-comppatibility only
+template <typename AAResT>
+using LLVMUnionFindAliasIterator = LLVMRawAliasIterator<AAResT>;
+
+/// For backwards-comppatibility only
+template <typename AAResT>
+using LLVMLocalUnionFindAliasIterator = LLVMLocalRawAliasIterator<AAResT>;
 
 namespace pag {
 /// Utility class to make pag::PBMixin<IndirectionSensUnionFindAA,
 /// LLVMCGProvider> implement PBStrategy.
 class LLVMCGProvider : public LLVMPAGDomain {
 public:
-  constexpr LLVMCGProvider(NonNullPtr<const LLVMBasedCallGraph> CG) noexcept
+  constexpr LLVMCGProvider(
+      NonNullPtr<const LLVMBasedCallGraph> CG PSR_LIFETIMEBOUND) noexcept
       : CG(CG) {}
 
   void withCalleesOfCallAt(n_t Inst,
@@ -70,273 +60,6 @@ class LLVMCGProvider : public LLVMPAGDomain {
 };
 } // namespace pag
 
-/// CRTP mixin that adds the LLVM alias-iterator interface to a class that
-/// holds a \c UnionFindAAResult and a \c ValueCompressor<PAGVariable>.
-///
-/// Provides \c forallAliasesOf(), \c mayAlias(), and \c alias() overloads
-/// accepting both \c llvm::Value* and \c ValueId arguments.  Results are
-/// reported as \c llvm::Value* via the stored \c ValueCompressor.
-///
-/// The derived class must expose a \c VC member (pointer to a
-/// \c ValueCompressor<PAGVariable>).
-///
-/// \tparam Derived The CRTP derived class.
-/// \tparam AAResT  A type satisfying \c UnionFindAAResult.
-template <typename Derived, typename AAResT>
-  requires UnionFindAAResult<std::remove_cvref_t<AAResT>>
-// NOLINTNEXTLINE(cppcoreguidelines-pro-type-member-init)
-struct LLVMUnionFindAliasIteratorMixin {
-  [[no_unique_address]] AAResT AARes;
-
-  using v_t = const llvm::Value *;
-  using n_t = const llvm::Instruction *;
-
-  [[nodiscard]] decltype(auto) getRawAliasSet(ValueId ValId) const {
-    return AARes.getRawAliasSet(ValId);
-  }
-
-  [[nodiscard]] const auto &base() const noexcept { return AARes; }
-
-  void
-  forallAliasesOf(ValueId VId, const auto & /*Inst*/,
-                  std::invocable<const llvm::Value *> auto Callback) const {
-    const auto &RawAliases = AARes.getRawAliasSet(VId);
-    RawAliases.foreach (
-        llvmUnionFindAliasHandler(*self().VC, copyOrRef(Callback)));
-  }
-
-  void
-  forallAliasesOf(const llvm::Value *Ptr, const auto &Inst,
-                  std::invocable<const llvm::Value *> auto Callback) const {
-    if (auto ValId = self().VC->getOrNull(Ptr)) {
-      forallAliasesOf(*ValId, Inst, copyOrRef(Callback));
-    }
-  }
-
-  [[nodiscard]] bool mayAlias(ValueId Ptr1, ValueId Ptr2) const {
-    return AARes.mayAlias(Ptr1, Ptr2);
-  }
-
-  [[nodiscard]] bool mayAlias(ValueId Ptr1, ValueId Ptr2,
-                              const auto & /*AtInstruction*/) const {
-    return AARes.mayAlias(Ptr1, Ptr2);
-  }
-
-  [[nodiscard]] bool mayAlias(const llvm::Value *Ptr1,
-                              const llvm::Value *Ptr2) const {
-    auto ValId1 = self().VC->getOrNull(Ptr1);
-    auto ValId2 = self().VC->getOrNull(Ptr2);
-
-    return ValId1 && ValId2 && mayAlias(*ValId1, *ValId2);
-  }
-
-  [[nodiscard]] bool mayAlias(const llvm::Value *Ptr1, const llvm::Value *Ptr2,
-                              const auto & /*AtInstruction*/) const {
-    return mayAlias(Ptr1, Ptr2);
-  }
-
-  [[nodiscard]] AliasResult alias(const llvm::Value *Ptr1,
-                                  const llvm::Value *Ptr2,
-                                  const auto &AtInstruction) const {
-    auto ValId1 = self().VC->getOrNull(Ptr1);
-    auto ValId2 = self().VC->getOrNull(Ptr2);
-    if (!ValId1 || !ValId2) {
-      return AliasResult::NoAlias;
-    }
-    if (*ValId1 == *ValId2) {
-      if (Ptr1 == Ptr2) {
-        return AliasResult::MustAlias;
-      }
-      return !llvm::isa<llvm::LoadInst>(Ptr1) &&
-                     !llvm::isa<llvm::LoadInst>(Ptr2)
-                 ? AliasResult::MustAlias
-                 : AliasResult::MayAlias;
-    }
-    return mayAlias(*ValId1, *ValId2, AtInstruction) ? AliasResult::MayAlias
-                                                     : AliasResult::NoAlias;
-  }
-
-  [[nodiscard]] constexpr const Derived &self() const noexcept {
-    return *static_cast<const Derived *>(this);
-  }
-};
-
-template <typename AAResT>
-  requires UnionFindAAResult<std::remove_cvref_t<AAResT>>
-// NOLINTNEXTLINE(cppcoreguidelines-pro-type-member-init)
-struct LLVMUnionFindAliasIterator
-    : public LLVMUnionFindAliasIteratorMixin<LLVMUnionFindAliasIterator<AAResT>,
-                                             AAResT> {
-  MaybeUniquePtr<const ValueCompressor<PAGVariable>> VC;
-
-  constexpr LLVMUnionFindAliasIterator(
-      AAResT &&AARes, MaybeUniquePtr<const ValueCompressor<PAGVariable>> VC)
-      : psr::LLVMUnionFindAliasIteratorMixin<LLVMUnionFindAliasIterator<AAResT>,
-                                             AAResT>{PSR_FWD(AARes)},
-        VC(std::move(VC)) {}
-};
-
-template <typename AAResT>
-LLVMUnionFindAliasIterator(AAResT,
-                           MaybeUniquePtr<const ValueCompressor<PAGVariable>>)
-    -> LLVMUnionFindAliasIterator<AAResT>;
-template <typename AAResT>
-LLVMUnionFindAliasIterator(AAResT, const ValueCompressor<PAGVariable> *)
-    -> LLVMUnionFindAliasIterator<AAResT>;
-
-namespace detail {
-class LLVMLocalUnionFindAliasIteratorBase {
-public:
-  explicit LLVMLocalUnionFindAliasIteratorBase(
-      const ValueCompressor<PAGVariable> &VC);
-
-protected:
-  llvm::DenseMap<const llvm::Function *, RawAliasSet<ValueId>> GlobalsOrInFun;
-};
-} // namespace detail
-
-/// CRTP mixin adding a function-local view on top of a global
-/// \c UnionFindAAResult.
-///
-/// Extends \c LLVMUnionFindAliasIteratorMixin with \c forallAliasesOf()
-/// overloads that accept an \c llvm::Function* or \c llvm::Instruction*
-/// context.  When a non-null context is provided, alias sets are intersected
-/// with the set of variables that are visible in that function (globals plus
-/// locals defined in that function), giving a function-local result even
-/// though the underlying analysis is interprocedural.
-template <typename Derived, typename AAResT>
-class LLVMLocalUnionFindAliasIteratorMixin
-    : public detail::LLVMLocalUnionFindAliasIteratorBase {
-public:
-  LLVMLocalUnionFindAliasIteratorMixin(AAResT &&AARes,
-                                       const ValueCompressor<PAGVariable> &VC)
-      : detail::LLVMLocalUnionFindAliasIteratorBase(VC), AARes(PSR_FWD(AARes)) {
-  }
-
-  [[nodiscard]] decltype(auto) getRawAliasSet(ValueId ValId) const {
-    return AARes.getRawAliasSet(ValId);
-  }
-
-  [[nodiscard]] auto getRawAliasSet(ValueId ValId,
-                                    const llvm::Function *Context) const {
-    auto Vars = AARes.getRawAliasSet(ValId);
-    if (Context) {
-      Vars &= getOrDefault(GlobalsOrInFun, Context);
-    }
-    return Vars;
-  }
-
-  [[nodiscard]] const auto &base() const noexcept { return AARes; }
-
-  [[nodiscard]] auto getRawAliasSet(ValueId ValId,
-                                    const llvm::Instruction *Context) const {
-    return getRawAliasSet(ValId, getFunction(Context));
-  }
-
-  void forallAliasesOf(ValueId VId, const llvm::Function *Context,
-                       std::invocable<const llvm::Value *> auto WithAlias) {
-    const auto AliasHandler =
-        llvmUnionFindAliasHandler(*self().VC, copyOrRef(WithAlias));
-
-    auto &&RawVars = AARes.getRawAliasSet(VId);
-    if (Context) {
-      auto Vars = PSR_FWD(RawVars);
-      Vars &= getOrDefault(GlobalsOrInFun, Context);
-      Vars.foreach (AliasHandler);
-    } else {
-      RawVars.foreach (AliasHandler);
-    }
-  }
-
-  void forallAliasesOf(const llvm::Value *Val, const llvm::Function *Context,
-                       std::invocable<const llvm::Value *> auto WithAlias) {
-    if (auto ValId = self().VC->getOrNull(Val)) {
-      forallAliasesOf(*ValId, Context, copyOrRef(WithAlias));
-    }
-  }
-
-  void forallAliasesOf(ValueId ValId, const llvm::Instruction *AtInstruction,
-                       std::invocable<const llvm::Value *> auto WithAlias) {
-    forallAliasesOf(ValId, psr::getFunction(AtInstruction),
-                    copyOrRef(WithAlias));
-  }
-
-  void forallAliasesOf(const llvm::Value *Val,
-                       const llvm::Instruction *AtInstruction,
-                       std::invocable<const llvm::Value *> auto WithAlias) {
-    forallAliasesOf(Val, psr::getFunction(AtInstruction), copyOrRef(WithAlias));
-  }
-
-  void forallAliasesOf(const llvm::Value *Val,
-                       std::invocable<const llvm::Value *> auto WithAlias) {
-    forallAliasesOf(Val, psr::getFunction(Val), copyOrRef(WithAlias));
-  }
-
-  [[nodiscard]] bool
-  mayAlias(ValueId ValId1, ValueId ValId2,
-           const llvm::Instruction * /*AtInstruction*/ = nullptr) const {
-    // XXX: Should we filter by AtInstruction-context here as well?
-    return AARes.mayAlias(ValId1, ValId2);
-  }
-
-  [[nodiscard]] bool
-  mayAlias(const llvm::Value *Ptr1, const llvm::Value *Ptr2,
-           const llvm::Instruction * /*AtInstruction*/ = nullptr) const {
-    auto ValId1 = self().VC->getOrNull(Ptr1);
-    auto ValId2 = self().VC->getOrNull(Ptr2);
-
-    // XXX: Should we filter by AtInstruction-context here as well?
-    return ValId1 && ValId2 && AARes.mayAlias(*ValId1, *ValId2);
-  }
-
-  [[nodiscard]] AliasResult alias(const llvm::Value *Ptr1,
-                                  const llvm::Value *Ptr2,
-                                  const auto &AtInstruction) const {
-    auto ValId1 = self().VC->getOrNull(Ptr1);
-    auto ValId2 = self().VC->getOrNull(Ptr2);
-    if (!ValId1 || !ValId2) {
-      return AliasResult::NoAlias;
-    }
-    if (*ValId1 == *ValId2) {
-      if (Ptr1 == Ptr2) {
-        return AliasResult::MustAlias;
-      }
-      return !llvm::isa<llvm::LoadInst>(Ptr1) &&
-                     !llvm::isa<llvm::LoadInst>(Ptr2)
-                 ? AliasResult::MustAlias
-                 : AliasResult::MayAlias;
-    }
-    return mayAlias(*ValId1, *ValId2, AtInstruction) ? AliasResult::MayAlias
-                                                     : AliasResult::NoAlias;
-  }
-
-  [[nodiscard]] constexpr const Derived &self() const noexcept {
-    return *static_cast<const Derived *>(this);
-  }
-
-private:
-  AAResT AARes;
-};
-
-template <typename AAResT>
-class LLVMLocalUnionFindAliasIterator
-    : public LLVMLocalUnionFindAliasIteratorMixin<
-          LLVMLocalUnionFindAliasIterator<AAResT>, AAResT> {
-  friend LLVMLocalUnionFindAliasIteratorMixin<
-      LLVMLocalUnionFindAliasIterator<AAResT>, AAResT>;
-
-public:
-  LLVMLocalUnionFindAliasIterator(
-      AAResT &&AARes, NonNullPtr<const ValueCompressor<PAGVariable>> VC)
-      : LLVMLocalUnionFindAliasIteratorMixin<
-            LLVMLocalUnionFindAliasIterator<AAResT>, AAResT>(PSR_FWD(AARes),
-                                                             *VC),
-        VC(VC) {}
-
-private:
-  NonNullPtr<const ValueCompressor<PAGVariable>> VC;
-};
-
 /// Low-level entry point: builds the PAG for \p IRDB using the given
 /// \p AnalysisT strategy, and returns the raw alias-analysis result (not
 /// wrapped in an \c LLVMUnionFindAliasIterator).
@@ -351,7 +74,7 @@ class LLVMLocalUnionFindAliasIterator
 template <pag::PBStrategy AnalysisT,
           std::derived_from<PAGBuilder<LLVMPAGDomain>> PAGBuilderImpl =
               LLVMPAGBuilder>
-[[nodiscard]] inline UnionFindAAResult auto computeUnionFindAARaw(
+[[nodiscard]] inline RawAAResult auto computeUnionFindAARaw(
     const LLVMProjectIRDB &IRDB, AnalysisT &&Ana,
     MaybeUniquePtr<ValueCompressor<PAGVariable>> VC = nullptr,
     PAGBuilderImpl Impl = LLVMPAGBuilder::withBuiltinMemSSA()) {
@@ -371,7 +94,7 @@ template <pag::PBStrategy AnalysisT,
 template <pag::CanOnAddEdge AnalysisT,
           std::derived_from<PAGBuilder<LLVMPAGDomain>> PAGBuilderImpl =
               LLVMPAGBuilder>
-[[nodiscard]] inline UnionFindAAResult auto computeUnionFindAARaw(
+[[nodiscard]] inline RawAAResult auto computeUnionFindAARaw(
     const LLVMProjectIRDB &IRDB, AnalysisT &&Ana, const LLVMBasedCallGraph &CG,
     MaybeUniquePtr<ValueCompressor<PAGVariable>> VC = nullptr,
     PAGBuilderImpl Impl = LLVMPAGBuilder::withBuiltinMemSSA()) {
@@ -391,13 +114,13 @@ template <pag::CanOnAddEdge AnalysisT,
 [[nodiscard]] BasicUnionFindAAResult computeIndSensUnionFindAARaw(
     const LLVMProjectIRDB &IRDB, const LLVMBasedCallGraph &CG,
     MaybeUniquePtr<ValueCompressor<PAGVariable>> VC = nullptr);
-[[nodiscard]] UnionFindAAResultIntersection<CallingContextSensUnionFindAAResult,
-                                            BasicUnionFindAAResult>
+[[nodiscard]] RawAAResultIntersection<CallingContextSensUnionFindAAResult,
+                                      BasicUnionFindAAResult>
 computeCtxIndSensUnionFindAARaw(
     const LLVMProjectIRDB &IRDB, const LLVMBasedCallGraph &CG,
     MaybeUniquePtr<ValueCompressor<PAGVariable>> VC = nullptr);
-[[nodiscard]] UnionFindAAResultIntersection<BasicUnionFindAAResult,
-                                            BasicUnionFindAAResult>
+[[nodiscard]] RawAAResultIntersection<BasicUnionFindAAResult,
+                                      BasicUnionFindAAResult>
 computeBotCtxIndSensUnionFindAARaw(
     const LLVMProjectIRDB &IRDB, const LLVMBasedCallGraph &CG,
     MaybeUniquePtr<ValueCompressor<PAGVariable>> VC = nullptr);
@@ -414,17 +137,17 @@ computeBotCtxIndSensUnionFindAARaw(
 template <pag::PBStrategy AnalysisT,
           std::derived_from<PAGBuilder<LLVMPAGDomain>> PAGBuilderImpl =
               LLVMPAGBuilder>
-[[nodiscard]] inline IsLLVMAliasIterator auto
-computeUnionFindAA(const LLVMProjectIRDB &IRDB, AnalysisT &&Ana,
-                   MaybeUniquePtr<ValueCompressor<PAGVariable>> VC = nullptr,
-                   PAGBuilderImpl Impl = LLVMPAGBuilder::withBuiltinMemSSA()) {
+[[nodiscard]] inline IsLLVMAliasIterator auto computeUnionFindAA(
+    const LLVMProjectIRDB &IRDB, AnalysisT &&Ana,
+    MaybeUniquePtr<ValueCompressor<PAGVariable>> VC PSR_LIFETIMEBOUND = nullptr,
+    PAGBuilderImpl Impl = LLVMPAGBuilder::withBuiltinMemSSA()) {
   if (!VC) {
     VC = std::make_unique<ValueCompressor<PAGVariable>>();
   }
 
   auto AARes =
       computeUnionFindAARaw(IRDB, PSR_FWD(Ana), VC.get(), std::move(Impl));
-  return LLVMUnionFindAliasIterator{
+  return LLVMRawAliasIterator{
       std::move(AARes),
       std::move(VC),
   };
@@ -433,11 +156,10 @@ computeUnionFindAA(const LLVMProjectIRDB &IRDB, AnalysisT &&Ana,
 template <pag::CanOnAddEdge AnalysisT,
           std::derived_from<PAGBuilder<LLVMPAGDomain>> PAGBuilderImpl =
               LLVMPAGBuilder>
-[[nodiscard]] inline IsLLVMAliasIterator auto
-computeUnionFindAA(const LLVMProjectIRDB &IRDB, AnalysisT &&Ana,
-                   const LLVMBasedCallGraph &CG,
-                   MaybeUniquePtr<ValueCompressor<PAGVariable>> VC = nullptr,
-                   PAGBuilderImpl Impl = LLVMPAGBuilder::withBuiltinMemSSA()) {
+[[nodiscard]] inline IsLLVMAliasIterator auto computeUnionFindAA(
+    const LLVMProjectIRDB &IRDB, AnalysisT &&Ana, const LLVMBasedCallGraph &CG,
+    MaybeUniquePtr<ValueCompressor<PAGVariable>> VC PSR_LIFETIMEBOUND = nullptr,
+    PAGBuilderImpl Impl = LLVMPAGBuilder::withBuiltinMemSSA()) {
   auto Strategy = pag::PBMixin{
       PSR_FWD(Ana),
       pag::LLVMCGProvider{&CG},
@@ -445,27 +167,32 @@ computeUnionFindAA(const LLVMProjectIRDB &IRDB, AnalysisT &&Ana,
   return computeUnionFindAA(IRDB, Strategy, std::move(VC), std::move(Impl));
 }
 
-[[nodiscard]] LLVMUnionFindAliasIterator<CallingContextSensUnionFindAAResult>
-computeCtxSensUnionFindAA(
-    const LLVMProjectIRDB &IRDB, const LLVMBasedCallGraph &CG,
-    MaybeUniquePtr<ValueCompressor<PAGVariable>> VC = nullptr);
-[[nodiscard]] LLVMUnionFindAliasIterator<BasicUnionFindAAResult>
-computeBotCtxSensUnionFindAA(
-    const LLVMProjectIRDB &IRDB, const LLVMBasedCallGraph &CG,
-    MaybeUniquePtr<ValueCompressor<PAGVariable>> VC = nullptr);
-[[nodiscard]] LLVMUnionFindAliasIterator<BasicUnionFindAAResult>
-computeIndSensUnionFindAA(
-    const LLVMProjectIRDB &IRDB, const LLVMBasedCallGraph &CG,
-    MaybeUniquePtr<ValueCompressor<PAGVariable>> VC = nullptr);
-[[nodiscard]] LLVMUnionFindAliasIterator<UnionFindAAResultIntersection<
+[[nodiscard]] LLVMRawAliasIterator<CallingContextSensUnionFindAAResult>
+computeCtxSensUnionFindAA(const LLVMProjectIRDB &IRDB,
+                          const LLVMBasedCallGraph &CG,
+                          MaybeUniquePtr<ValueCompressor<PAGVariable>> VC
+                              PSR_LIFETIMEBOUND = nullptr);
+[[nodiscard]] LLVMRawAliasIterator<BasicUnionFindAAResult>
+computeBotCtxSensUnionFindAA(const LLVMProjectIRDB &IRDB,
+                             const LLVMBasedCallGraph &CG,
+                             MaybeUniquePtr<ValueCompressor<PAGVariable>> VC
+                                 PSR_LIFETIMEBOUND = nullptr);
+[[nodiscard]] LLVMRawAliasIterator<BasicUnionFindAAResult>
+computeIndSensUnionFindAA(const LLVMProjectIRDB &IRDB,
+                          const LLVMBasedCallGraph &CG,
+                          MaybeUniquePtr<ValueCompressor<PAGVariable>> VC
+                              PSR_LIFETIMEBOUND = nullptr);
+[[nodiscard]] LLVMRawAliasIterator<RawAAResultIntersection<
     CallingContextSensUnionFindAAResult, BasicUnionFindAAResult>>
-computeCtxIndSensUnionFindAA(
-    const LLVMProjectIRDB &IRDB, const LLVMBasedCallGraph &CG,
-    MaybeUniquePtr<ValueCompressor<PAGVariable>> VC = nullptr);
-[[nodiscard]] LLVMUnionFindAliasIterator<UnionFindAAResultIntersection<
-    BasicUnionFindAAResult, BasicUnionFindAAResult>>
-computeBotCtxIndSensUnionFindAA(
-    const LLVMProjectIRDB &IRDB, const LLVMBasedCallGraph &CG,
-    MaybeUniquePtr<ValueCompressor<PAGVariable>> VC = nullptr);
+computeCtxIndSensUnionFindAA(const LLVMProjectIRDB &IRDB,
+                             const LLVMBasedCallGraph &CG,
+                             MaybeUniquePtr<ValueCompressor<PAGVariable>> VC
+                                 PSR_LIFETIMEBOUND = nullptr);
+[[nodiscard]] LLVMRawAliasIterator<
+    RawAAResultIntersection<BasicUnionFindAAResult, BasicUnionFindAAResult>>
+computeBotCtxIndSensUnionFindAA(const LLVMProjectIRDB &IRDB,
+                                const LLVMBasedCallGraph &CG,
+                                MaybeUniquePtr<ValueCompressor<PAGVariable>> VC
+                                    PSR_LIFETIMEBOUND = nullptr);
 
 } // namespace psr
diff --git a/include/phasar/PhasarLLVM/Pointer/LLVMUnionFindAliasSet.h b/include/phasar/PhasarLLVM/Pointer/LLVMUnionFindAliasSet.h
index 06675f30da..6209e569a4 100644
--- a/include/phasar/PhasarLLVM/Pointer/LLVMUnionFindAliasSet.h
+++ b/include/phasar/PhasarLLVM/Pointer/LLVMUnionFindAliasSet.h
@@ -9,208 +9,9 @@
  *     Fabian Schiebel and others
  *****************************************************************************/
 
-#include "phasar/PhasarLLVM/ControlFlow/LLVMBasedCallGraph.h"
-#include "phasar/PhasarLLVM/Pointer/LLVMAliasSet.h"
-#include "phasar/PhasarLLVM/Pointer/LLVMPointerAssignmentGraph.h"
-#include "phasar/PhasarLLVM/Pointer/LLVMPointsToUtils.h"
-#include "phasar/Pointer/AliasAnalysisType.h"
-#include "phasar/Pointer/AliasInfoTraits.h"
-#include "phasar/Pointer/AliasResult.h"
-#include "phasar/Pointer/AliasSetOwner.h"
-#include "phasar/Pointer/RawAliasSet.h"
-#include "phasar/Pointer/UnionFindAliasAnalysisType.h"
-#include "phasar/Utils/AnalysisProperties.h"
-#include "phasar/Utils/TypedVector.h"
-#include "phasar/Utils/ValueCompressor.h"
-
-#include <memory>
-#include <type_traits>
-
-namespace llvm {
-class Value;
-class Instruction;
-class Function;
-} // namespace llvm
+#include "phasar/PhasarLLVM/Pointer/LLVMRawAliasSet.h"
 
 namespace psr {
-
-class LLVMUnionFindAliasSet;
-class LLVMProjectIRDB;
-
-template <>
-struct AliasInfoTraits<LLVMUnionFindAliasSet>
-    : DefaultAATraits<const llvm::Value *, const llvm::Instruction *> {};
-
-/// Concrete \c IsAliasInfo implementation backed by a union-find alias
-/// analysis.
-///
-/// Constructed once from an \c LLVMProjectIRDB and a call graph; the chosen
-/// analysis variant is determined by \c Config.  Alias sets are materialized
-/// lazily on first query and cached per \c ValueId in \c AliasSets.
-///
-/// \note When \c AnalysisLocality::FunctionLocal is selected, alias sets are
-///   filtered to variables visible in the function that contains the query
-///   instruction.  The per-\c ValueId cache does **not** account for the
-///   instruction context, so the first caller's function wins — do not mix
-///   queries to local pointers from different functions for the same value in
-///   local mode.
-class LLVMUnionFindAliasSet
-    : public AnalysisPropertiesMixin<LLVMUnionFindAliasSet> {
-public:
-  using traits_t = AliasInfoTraits<LLVMUnionFindAliasSet>;
-  using n_t = traits_t::n_t;
-  using v_t = traits_t::v_t;
-  using AliasSetTy = traits_t::AliasSetTy;
-  using AliasSetPtrTy = traits_t::AliasSetPtrTy;
-  using AllocationSiteSetPtrTy = traits_t::AllocationSiteSetPtrTy;
-
-  /// Whether alias sets are reported globally or filtered to the function
-  /// containing the query instruction.
-  enum class AnalysisLocality : uint8_t {
-    /// All aliases across all functions are reported.
-    Global,
-    /// Aliases are intersected with variables visible in the querying function
-    /// (globals + function-local values).
-    FunctionLocal,
-  };
-
-  struct Config {
-    /// The specific union-find analysis variant to run (default:
-    /// \c BotCtxIndSens — bottom-up, context- and indirection-sensitive).
-    UnionFindAliasAnalysisType AType =
-        UnionFindAliasAnalysisType::BotCtxIndSens;
-    /// Controls whether alias sets are scoped to the querying function.
-    AnalysisLocality ALocality = AnalysisLocality::Global;
-  };
-
-  explicit LLVMUnionFindAliasSet(const LLVMProjectIRDB *IRDB,
-                                 const LLVMBasedCallGraph &BaseCG, Config Cfg,
-                                 ValueCompressor<PAGVariable> *VC);
-  explicit LLVMUnionFindAliasSet(const LLVMProjectIRDB *IRDB,
-                                 const LLVMBasedCallGraph &BaseCG, Config Cfg)
-      : LLVMUnionFindAliasSet(IRDB, BaseCG, Cfg, nullptr) {}
-  explicit LLVMUnionFindAliasSet(const LLVMProjectIRDB *IRDB,
-                                 const LLVMBasedCallGraph &BaseCG)
-      : LLVMUnionFindAliasSet(IRDB, BaseCG, Config{}, nullptr) {}
-
-  [[nodiscard]] constexpr std::true_type isInterProcedural() const noexcept {
-    return {};
-  };
-
-  [[nodiscard]] constexpr std::integral_constant<AliasAnalysisType,
-                                                 AliasAnalysisType::UnionFind>
-  getAliasAnalysisType() const noexcept {
-    return {};
-  };
-
-  [[nodiscard]] constexpr AnalysisProperties
-  getAnalysisProperties() const noexcept {
-    return Props;
-  }
-
-  [[nodiscard]] constexpr AliasResult alias(v_t V1, v_t V2, n_t I) const {
-    assert(isValid());
-    return AARes->alias(V1, V2, I);
-  }
-
-  void foreachAliasOf(v_t V, n_t I,
-                      llvm::function_ref<void(v_t)> WithAlias) const {
-    assert(isValid());
-    AARes->forallAliasesOf(V, I, WithAlias);
-  }
-
-  [[nodiscard]] AliasSetPtrTy getAliasSet(v_t V, n_t I) {
-    assert(isValid());
-    auto ValId = AARes->VC->getOrNull(V);
-    if (!ValId) {
-      return getEmptyAliasSet();
-    }
-
-    assert(AliasSets.inbounds(*ValId));
-    if (!AliasSets[*ValId]) [[unlikely]] {
-      AliasSets[*ValId] = AARes->constructAliasSet(*ValId, I, Owner);
-    }
-
-    return AliasSets[*ValId];
-  }
-
-  [[nodiscard]] AllocationSiteSetPtrTy
-  getReachableAllocationSites(v_t V, bool IntraProcOnly, n_t I) const {
-    assert(isValid());
-    auto ValId = AARes->VC->getOrNull(V);
-    if (!ValId) {
-      return std::make_unique<AliasSetTy>();
-    }
-
-    return AARes->constructReachableAllocSites(V, *ValId, IntraProcOnly, I);
-  }
-
-  [[nodiscard]] bool isInReachableAllocationSites(
-      const llvm::Value *V, const llvm::Value *PotentialValue,
-      bool IntraProcOnly, const llvm::Instruction *I) const {
-    assert(isValid());
-    if (!psr::isInterestingPointer(V)) {
-      return false;
-    }
-
-    if (!psr::isInReachableAllocationSitesTy(V, PotentialValue,
-                                             IntraProcOnly)) {
-      return false;
-    }
-
-    return alias(V, PotentialValue, I) != AliasResult::NoAlias;
-  }
-
-  void print(llvm::raw_ostream &OS) const;
-  void printAsJson(llvm::raw_ostream &OS) const;
-
-  [[nodiscard]] bool isValid() const noexcept {
-    return AARes != nullptr && Props != AnalysisProperties::None &&
-           AARes->VC != nullptr && AARes->VC->size() == AliasSets.size();
-  }
-
-private:
-  struct UnionFindAAResultConcept {
-    MaybeUniquePtr<const ValueCompressor<PAGVariable>> VC;
-    std::optional<RawAliasSet<ValueId>> AllocationSites{};
-
-    UnionFindAAResultConcept(
-        MaybeUniquePtr<const ValueCompressor<PAGVariable>> VC) noexcept
-        : VC(std::move(VC)) {}
-    virtual ~UnionFindAAResultConcept() = default;
-
-    virtual void forallAliasesOf(v_t Ptr, n_t Inst,
-                                 llvm::function_ref<void(v_t)> Callback) = 0;
-
-    virtual AliasResult alias(v_t Ptr1, v_t Ptr2, n_t AtInstruction) = 0;
-
-    virtual AliasSetPtrTy
-    constructAliasSet(ValueId ValId, n_t Inst,
-                      AliasSetOwner<AliasSetTy> &Owner) = 0;
-
-    virtual AllocationSiteSetPtrTy
-    constructReachableAllocSites(v_t V, ValueId ValId, bool IntraProcOnly,
-                                 n_t Inst) = 0;
-
-    virtual void print(llvm::raw_ostream &OS, Config Cfg) const = 0;
-  };
-
-  template <template <typename, typename> typename AAResIterT, typename AAResT>
-  struct UnionFindAAResultModel;
-
-  [[nodiscard]] static BoxedPtr<AliasSetTy> getEmptyAliasSet();
-
-  // --- data members:
-
-  std::unique_ptr<UnionFindAAResultConcept> AARes{};
-  AnalysisProperties Props{};
-  Config Cfg{};
-
-  AliasSetOwner<AliasSetTy>::memory_resource_type MRes{};
-  AliasSetOwner<AliasSetTy> Owner{&MRes};
-  TypedVector<ValueId, AliasSetPtrTy> AliasSets;
-};
-
-[[nodiscard]] llvm::StringRef
-to_string(LLVMUnionFindAliasSet::AnalysisLocality ALoc) noexcept;
+/// For backwards compatibility only
+using LLVMUnionFindAliasSet = LLVMRawAliasSet;
 } // namespace psr
diff --git a/include/phasar/Pointer/AliasAnalysisType.def b/include/phasar/Pointer/AliasAnalysisType.def
index c7359ff64c..a94239de2c 100644
--- a/include/phasar/Pointer/AliasAnalysisType.def
+++ b/include/phasar/Pointer/AliasAnalysisType.def
@@ -17,6 +17,8 @@ ALIAS_ANALYSIS_TYPE(CFLAnders, "cflanders", "Andersen-style alias analysis (subs
 ALIAS_ANALYSIS_TYPE(PointsTo, "points-to", "Alias-information based on (external) points-to information")
 ALIAS_ANALYSIS_TYPE(UnionFind, "union-find", "Steensgaard-style alias analysis based on union-find structures")
 ALIAS_ANALYSIS_TYPE(AndersenOTF, "andersen-otf", "Andersen-style inclusion-based on-the-fly points-to analysis")
+ALIAS_ANALYSIS_TYPE(AndersenOTFCtx, "andersen-otf-ctx", "Andersen-style inclusion-based on-the-fly points-to analysis with full k=1 context sensitivity")
+ALIAS_ANALYSIS_TYPE(AndersenOTFDynCtx, "andersen-otf-dynctx", "Andersen-style inclusion-based on-the-fly points-to analysis with dynamically-selective k=1 context sensitivity")
 
 #ifdef PHASAR_USE_SVF
 ALIAS_ANALYSIS_TYPE(SVFDDA, "svf-dda", "Alias-information based on SVF's ContextDDA analysis. Requires SVF.")
diff --git a/include/phasar/Pointer/AliasAnalysisType.h b/include/phasar/Pointer/AliasAnalysisType.h
index 8a9fb35b15..eca9d05636 100644
--- a/include/phasar/Pointer/AliasAnalysisType.h
+++ b/include/phasar/Pointer/AliasAnalysisType.h
@@ -16,6 +16,17 @@ enum class AliasAnalysisType {
   Invalid
 };
 
+[[nodiscard]] constexpr bool isAndersenOTFAA(AliasAnalysisType AATy) noexcept {
+  switch (AATy) {
+  case AliasAnalysisType::AndersenOTF:
+  case AliasAnalysisType::AndersenOTFCtx:
+  case AliasAnalysisType::AndersenOTFDynCtx:
+    return true;
+  default:
+    return false;
+  }
+}
+
 std::string toString(AliasAnalysisType PA);
 
 AliasAnalysisType toAliasAnalysisType(llvm::StringRef S);
diff --git a/include/phasar/Pointer/BottomupUnionFindAA.h b/include/phasar/Pointer/BottomupUnionFindAA.h
index 319621cac1..f23657a3f2 100644
--- a/include/phasar/Pointer/BottomupUnionFindAA.h
+++ b/include/phasar/Pointer/BottomupUnionFindAA.h
@@ -30,6 +30,7 @@
 #include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/SmallVector.h"
 
+#include <cassert>
 #include <cstdint>
 #include <optional>
 #include <unordered_map>
@@ -140,6 +141,7 @@ class BottomupUnionFindAA : BottomupUnionFindAABase {
   }
 
   void onAddValue(ByConstRef<v_t> Var, ValueId VId) {
+    assert(size_t(VId) == SCCOfVal.size() && "Expect ascending VIds");
     auto &SccPlace = SCCOfVal.emplace_back(InvalidSCC);
     if (auto &&Fun = getFunction(Var)) {
       if (auto FunVtx = RevCG.FC.getOrNull(Fun)) {
diff --git a/include/phasar/Pointer/PointerAssignmentGraph.h b/include/phasar/Pointer/PointerAssignmentGraph.h
index f111659f4b..0b67165422 100644
--- a/include/phasar/Pointer/PointerAssignmentGraph.h
+++ b/include/phasar/Pointer/PointerAssignmentGraph.h
@@ -328,9 +328,9 @@ template <typename AnalysisDomainT> class PBStrategyRef final {
     VT->OnAddEdge(Ctx, From, To, E, AtInstruction);
   }
 
-  /// Called by buildPAG() for every (unique) node that should be added to the
-  /// PAG, *excluding* nodes that have already been registered in the used
-  /// ValueCompressor before buildPAG() was called.
+  /// Called by buildPAG() once per (unique) PAG node, with ascending VIds
+  /// starting at zero. Nodes already present in a pre-populated
+  /// ValueCompressor are reported first, before the PAG is traversed.
   ///
   /// \param Variable The IR-specific variable/value for which the new node
   /// has been created.
diff --git a/include/phasar/Pointer/RawAAResult.h b/include/phasar/Pointer/RawAAResult.h
new file mode 100644
index 0000000000..a914aefdd6
--- /dev/null
+++ b/include/phasar/Pointer/RawAAResult.h
@@ -0,0 +1,55 @@
+#pragma once
+
+/******************************************************************************
+ * Copyright (c) 2026 Fabian Schiebel.
+ * All rights reserved. This program and the accompanying materials are made
+ * available under the terms of LICENSE.txt.
+ *
+ * Contributors:
+ *     Fabian Schiebel and others
+ *****************************************************************************/
+
+#include "phasar/Pointer/RawAliasSet.h"
+#include "phasar/Utils/ValueCompressor.h"
+
+namespace psr {
+
+/// Base interface for results of a ValueId-based alias-analysis.
+template <typename T>
+concept RawAAResult = requires(const T &Result, ValueId Var) {
+  { T::isCached() } noexcept -> std::convertible_to<bool>;
+  { Result.getRawAliasSet(Var) } -> std::convertible_to<RawAliasSet<ValueId>>;
+  { Result.mayAlias(Var, Var) } -> std::convertible_to<bool>;
+  { Result.size() } noexcept -> std::convertible_to<size_t>;
+};
+
+/// The intersection of two (different) independent raw alias-analysis results.
+/// Use this to achieve better precision than feasible with a single analysis.
+template <RawAAResult FirstT, RawAAResult SecondT>
+struct RawAAResultIntersection {
+  [[nodiscard]] static constexpr bool isCached() noexcept {
+    // The set-intersection is not cached
+    return false;
+  }
+
+  [[nodiscard]] constexpr size_t size() const noexcept {
+    assert(
+        First.size() == Second.size() &&
+        "Only alias-results on the same ValueCompressor should be intersected");
+    return First.size();
+  }
+
+  [[nodiscard]] RawAliasSet<ValueId> getRawAliasSet(ValueId Var) const {
+    auto ResultSet = First.getRawAliasSet(Var);
+    ResultSet &= Second.getRawAliasSet(Var);
+    return ResultSet;
+  }
+
+  [[nodiscard]] constexpr bool mayAlias(ValueId Var1, ValueId Var2) const {
+    return First.mayAlias(Var1, Var2) && Second.mayAlias(Var1, Var2);
+  }
+
+  [[no_unique_address]] FirstT First;
+  [[no_unique_address]] SecondT Second;
+};
+} // namespace psr
diff --git a/include/phasar/Pointer/RawAliasSet.h b/include/phasar/Pointer/RawAliasSet.h
index f92994230d..bebfcc4c23 100644
--- a/include/phasar/Pointer/RawAliasSet.h
+++ b/include/phasar/Pointer/RawAliasSet.h
@@ -9,16 +9,10 @@
  *     Fabian Schiebel and others
  *****************************************************************************/
 
+#include "phasar/Utils/SparseBitSet.h"
 #include "phasar/Utils/TypeTraits.h"
-#include "phasar/Utils/Utilities.h"
-
-#include "llvm/ADT/ArrayRef.h"
-#include "llvm/ADT/SparseBitVector.h"
-
-#include "roaring/roaring.hh"
 
 #include <concepts>
-#include <type_traits>
 
 namespace psr {
 
@@ -64,235 +58,10 @@ concept IsRawAliasSet = requires(ASet &MutSet, const ASet &ConstSet,
   } -> std::convertible_to<bool>;
 };
 
-/// Sparse bit-set used to represent alias sets in union-find analyses.
-///
-/// Currently backed by \c llvm::SparseBitVector for compact storage when ids
-/// are scattered in a large range and dense storage when ids are clustered.
-/// Satisfies \c IsRawAliasSet.
-///
-/// \tparam IdT Integer-like id type (e.g., \c ValueId).
-template <SmallIdType IdT> class LLVMRawAliasSet {
-public:
-  using value_type = IdT;
-
-  LLVMRawAliasSet() = default;
-
-  void insert(IdT Id) { Bits.set(uint32_t(Id)); }
-
-  [[nodiscard]] bool tryInsert(IdT Id) {
-    return Bits.test_and_set(uint32_t(Id));
-  }
-
-  [[nodiscard]] bool contains(IdT Id) const { return Bits.test(uint32_t(Id)); }
-
-  template <std::invocable<IdT> HandlerFn>
-  LLVM_ATTRIBUTE_ALWAYS_INLINE void foreach (HandlerFn Handler) const {
-    for (auto Bit : Bits) {
-      if constexpr (std::convertible_to<std::invoke_result_t<HandlerFn &, IdT>,
-                                        bool>) {
-        if (!std::invoke(Handler, IdT(Bit))) {
-          break;
-        }
-      } else {
-        std::invoke(Handler, IdT(Bit));
-      }
-    }
-  }
-
-  void operator|=(const LLVMRawAliasSet &Other) { Bits |= Other.Bits; }
-  void operator&=(const LLVMRawAliasSet &Other) { Bits &= Other.Bits; }
-  void operator-=(const LLVMRawAliasSet &Other) {
-    Bits.intersectWithComplement(Other.Bits);
-  }
-
-  [[nodiscard]] LLVMRawAliasSet operator-(const LLVMRawAliasSet &Other) const {
-    LLVMRawAliasSet Ret;
-    Ret.Bits = Bits - Other.Bits;
-    return Ret;
-  }
-
-  [[nodiscard]] bool empty() const noexcept { return Bits.empty(); }
-  [[nodiscard]] size_t size() const noexcept { return Bits.count(); }
-
-  void clear() noexcept { Bits.clear(); }
-
-  [[nodiscard]] auto begin() const noexcept { return Bits.begin(); }
-  [[nodiscard]] auto end() const noexcept { return Bits.end(); }
-
-  [[nodiscard]] bool tryMergeWith(const LLVMRawAliasSet &Other) {
-    return Bits |= Other.Bits;
-  }
-
-  void erase(IdT Id) { Bits.reset(uint32_t(Id)); }
-
-  [[nodiscard]] bool operator==(const LLVMRawAliasSet &Other) const noexcept {
-    return Bits == Other.Bits;
-  }
-
-  bool mergeWithDiff(const LLVMRawAliasSet &Other,
-                     std::invocable<IdT> auto WithNewElem,
-                     LLVMRawAliasSet &IntoDiff) {
-    return mergeWithDiffImpl(Other, copyOrRef(WithNewElem), &IntoDiff);
-  }
-
-  bool mergeWithDiff(const LLVMRawAliasSet &Other,
-                     std::invocable<IdT> auto WithNewElem) {
-    return mergeWithDiffImpl(Other, copyOrRef(WithNewElem), nullptr);
-  }
-
-private:
-  bool mergeWithDiffImpl(const LLVMRawAliasSet &Other,
-                         std::invocable<IdT> auto WithNewElem,
-                         LLVMRawAliasSet *IntoDiff) {
-    auto Diff = Other.Bits - Bits;
-    if (Diff.empty()) {
-      return false;
-    }
-
-    Bits |= Diff;
-    if (IntoDiff) {
-      IntoDiff->Bits |= Diff;
-    }
-    for (auto Elem : Diff) {
-      std::invoke(WithNewElem, IdT(Elem));
-    }
-    return true;
-  }
-
-  llvm::SparseBitVector<> Bits;
-};
-
-template <SmallIdType IdT> class RoaringAliasSet {
-public:
-  using value_type = IdT;
-
-  RoaringAliasSet() = default;
-
-  void insert(IdT Id) { Bits.add(uint32_t(Id)); }
-
-  [[nodiscard]] bool tryInsert(IdT Id) { return Bits.addChecked(uint32_t(Id)); }
-
-  [[nodiscard]] bool contains(IdT Id) const {
-    return Bits.contains(uint32_t(Id));
-  }
-
-  template <std::invocable<IdT> HandlerFn>
-  LLVM_ATTRIBUTE_ALWAYS_INLINE void foreach (HandlerFn Handler) const {
-    return Bits.iterate(
-        [](uint32_t Id, void *HandlerPtr) {
-          auto &Handler = *(HandlerFn *)HandlerPtr;
-          if constexpr (std::convertible_to<
-                            std::invoke_result_t<HandlerFn &, IdT>, bool>) {
-            if (!std::invoke(Handler, IdT(Id))) {
-              return false;
-            }
-          } else {
-            std::invoke(Handler, IdT(Id));
-          }
-          return true;
-        },
-        &Handler);
-  }
-
-  void operator|=(const RoaringAliasSet &Other) { Bits |= Other.Bits; }
-  void operator&=(const RoaringAliasSet &Other) { Bits &= Other.Bits; }
-  void operator-=(const RoaringAliasSet &Other) { Bits -= Other.Bits; }
-  [[nodiscard]] RoaringAliasSet operator-(const RoaringAliasSet &Other) const {
-    return Bits - Other.Bits;
-  }
-
-  [[nodiscard]] bool empty() const noexcept { return Bits.isEmpty(); }
-  [[nodiscard]] size_t size() const noexcept { return Bits.cardinality(); }
-
-  void clear() noexcept { Bits.clear(); }
-
-  [[nodiscard]] auto begin() const noexcept { return Bits.begin(); }
-  [[nodiscard]] auto end() const noexcept { return Bits.end(); }
-
-  [[nodiscard]] bool tryMergeWith(const RoaringAliasSet &Other) {
-    auto OldSz = size();
-    Bits |= Other.Bits;
-    return size() != OldSz;
-  }
-
-  void erase(IdT Id) { Bits.remove(uint32_t(Id)); }
-
-  // Bulk-inserts from a sorted, deduplicated array.
-  // Roaring constructs containers in O(N) for sorted input.
-  void insertSorted(llvm::ArrayRef<uint32_t> Sorted) {
-    Bits.addMany(Sorted.size(), Sorted.data());
-  }
-
-  [[nodiscard]] bool operator==(const RoaringAliasSet &Other) const noexcept {
-    return Bits == Other.Bits;
-  }
-
-  bool mergeWithDiff(const RoaringAliasSet &Other,
-                     std::invocable<IdT> auto WithNewElem) {
-    constexpr size_t DiffThreshold = 16;
-    // operator- is expensive, but it is definitely a lot faster than the
-    // foreach loop if UPending is large
-
-    if (Other.size() > DiffThreshold) {
-      RoaringAliasSet Diff = Other - *this;
-      if (Diff.empty()) {
-        return false;
-      }
-
-      *this |= Diff;
-
-      Diff.foreach (copyOrRef(WithNewElem));
-      return true;
-    }
-
-    bool Ret = false;
-    Other.foreach ([&](IdT Elem) {
-      if (tryInsert(Elem)) {
-        std::invoke(WithNewElem, Elem);
-        Ret = true;
-      }
-    });
-    return Ret;
-  }
-
-  bool mergeWithDiff(const RoaringAliasSet &Other,
-                     std::invocable<IdT> auto WithNewElem,
-                     RoaringAliasSet &IntoDiff) {
-    constexpr size_t DiffThreshold = 16;
-    // operator- is expensive, but it is definitely a lot faster than the
-    // foreach loop if Other is large
-
-    if (Other.size() > DiffThreshold) {
-      RoaringAliasSet Diff = Other - *this;
-      if (Diff.empty()) {
-        return false;
-      }
-
-      *this |= Diff;
-      IntoDiff |= Diff;
-
-      Diff.foreach (copyOrRef(WithNewElem));
-      return true;
-    }
-
-    bool Ret = false;
-    Other.foreach ([&](IdT Elem) {
-      if (tryInsert(Elem)) {
-        IntoDiff.insert(Elem);
-        std::invoke(WithNewElem, Elem);
-        Ret = true;
-      }
-    });
-
-    return Ret;
-  }
-
-private:
-  RoaringAliasSet(roaring::Roaring &&RR) : Bits(std::move(RR)) {}
-
-  roaring::Roaring Bits{};
-};
+/// For backwards-compatibility only
+template <SmallIdType IdT> using RoaringAliasSet = SparseBitSet<IdT>;
 
+/// The default type used for alias/points-to sets
 template <SmallIdType IdT> using RawAliasSet = RoaringAliasSet<IdT>;
 
 } // namespace psr
diff --git a/include/phasar/Pointer/UnionFindAA.h b/include/phasar/Pointer/UnionFindAA.h
index f48472fa67..2b961efaa5 100644
--- a/include/phasar/Pointer/UnionFindAA.h
+++ b/include/phasar/Pointer/UnionFindAA.h
@@ -12,6 +12,7 @@
 #include "phasar/ControlFlow/CallGraph.h"
 #include "phasar/Pointer/CallingContextConstructor.h"
 #include "phasar/Pointer/PointerAssignmentGraph.h"
+#include "phasar/Pointer/RawAAResult.h"
 #include "phasar/Pointer/RawAliasSet.h"
 #include "phasar/Utils/ByRef.h"
 #include "phasar/Utils/IotaIterator.h"
@@ -33,51 +34,19 @@
 #include "llvm/ADT/STLExtras.h"
 #include "llvm/Support/ErrorHandling.h"
 
+#include <cassert>
 #include <concepts>
 #include <functional>
 #include <type_traits>
 
 namespace psr {
 
-/// Base interface for results of a union-find alias-analysis.
+/// For backwards-compatibility only
 template <typename T>
-concept UnionFindAAResult = requires(const T &Result, ValueId Var) {
-  { T::isCached() } noexcept -> std::convertible_to<bool>;
-  { Result.getRawAliasSet(Var) } -> std::convertible_to<RawAliasSet<ValueId>>;
-  { Result.mayAlias(Var, Var) } -> std::convertible_to<bool>;
-  { Result.size() } noexcept -> std::convertible_to<size_t>;
-};
-
-/// The intersection of two (different) independent union-find alias-analysis
-/// results.
-/// Use this to achieve better precision than feasible with a single analysis.
-template <UnionFindAAResult FirstT, UnionFindAAResult SecondT>
-struct UnionFindAAResultIntersection {
-  [[nodiscard]] static constexpr bool isCached() noexcept {
-    // The set-intersection is not cached
-    return false;
-  }
-
-  [[nodiscard]] constexpr size_t size() const noexcept {
-    assert(
-        First.size() == Second.size() &&
-        "Only alias-results on the same ValueCompressor should be intersected");
-    return First.size();
-  }
+concept UnionFindAAResult = RawAAResult<T>;
 
-  [[nodiscard]] RawAliasSet<ValueId> getRawAliasSet(ValueId Var) const {
-    auto ResultSet = First.getRawAliasSet(Var);
-    ResultSet &= Second.getRawAliasSet(Var);
-    return ResultSet;
-  }
-
-  [[nodiscard]] constexpr bool mayAlias(ValueId Var1, ValueId Var2) const {
-    return First.mayAlias(Var1, Var2) && Second.mayAlias(Var1, Var2);
-  }
-
-  [[no_unique_address]] FirstT First;
-  [[no_unique_address]] SecondT Second;
-};
+template <RawAAResult FirstT, RawAAResult SecondT>
+using UnionFindAAResultIntersection = RawAAResultIntersection<FirstT, SecondT>;
 
 /// Specialization of \c PBStrategyCombinator for two union-find analyses whose
 /// results should be intersected for better precision.  Both analyses must
@@ -97,9 +66,9 @@ struct UnionFindAACombinator
                                                    PSR_FWD(Second)} {}
 
   template <std::predicate<ValueId> FilterFn = TrueFn>
-  [[nodiscard]] UnionFindAAResult auto
+  [[nodiscard]] RawAAResult auto
   consumeAAResults(size_t NumVars, FilterFn ShouldInclude = {}) && {
-    return UnionFindAAResultIntersection{
+    return RawAAResultIntersection{
         std::move(this->First).consumeAAResults(NumVars, ShouldInclude),
         std::move(this->Second)
             .consumeAAResults(NumVars, std::move(ShouldInclude)),
@@ -111,7 +80,7 @@ template <typename FirstT, typename SecondT>
 UnionFindAACombinator(FirstT, SecondT)
     -> UnionFindAACombinator<FirstT, SecondT>;
 
-/// Lazy cache that wraps any \c UnionFindAAResult and memoises
+/// Lazy cache that wraps any \c RawAAResult and memoises
 /// \c getRawAliasSet() results in a \c ValueIdMap.
 ///
 /// Not thread-safe. Each unique \p ValueId is computed at most once on first
@@ -122,7 +91,7 @@ UnionFindAACombinator(FirstT, SecondT)
 ///   \c mayAlias() is forwarded directly to the underlying result without
 ///   materializing a set, which can be faster for analyses whose
 ///   \c mayAlias() implementation is already O(1).
-template <UnionFindAAResult AAResT, bool ShouldCacheMayAlias = true>
+template <RawAAResult AAResT, bool ShouldCacheMayAlias = true>
 class CachedUnionFindAAResult {
 public:
   explicit CachedUnionFindAAResult(AAResT &&AARes) : AARes(std::move(AARes)) {
@@ -157,7 +126,7 @@ class CachedUnionFindAAResult {
 
 /// Implements the AliasIterator interface on union-find alias-analysis results.
 template <typename AAResT, typename Var2IdMapper, typename Id2VarMapper>
-  requires UnionFindAAResult<std::remove_cvref_t<AAResT>>
+  requires RawAAResult<std::remove_cvref_t<AAResT>>
 struct UnionFindAliasIterator {
   [[no_unique_address]] AAResT AARes;
   [[no_unique_address]] Var2IdMapper Var2Id;
@@ -343,8 +312,8 @@ class CallingContextSensUnionFindAA {
   using db_t = typename AnalysisDomainT::db_t;
 
   constexpr CallingContextSensUnionFindAA(
-      NonNullPtr<const CallGraph<n_t, f_t>> CG,
-      NonNullPtr<const db_t> IRDB) noexcept
+      NonNullPtr<const CallGraph<n_t, f_t>> CG PSR_LIFETIMEBOUND,
+      NonNullPtr<const db_t> IRDB PSR_LIFETIMEBOUND) noexcept
       : CG(CG), IRDB(IRDB) {}
 
   void onAddEdge(ValueId From, ValueId To, pag::Edge E,
@@ -386,6 +355,7 @@ class CallingContextSensUnionFindAA {
   }
 
   void onAddValue(ByConstRef<v_t> Var, ValueId VId) {
+    assert(size_t(VId) == Var2Obj.size() && "Expect ascending VIds");
     Var2Obj.emplace_back();
     if (const auto &Fun = getFunction(Var)) {
       CC.visitAllCallingContexts(
@@ -548,6 +518,7 @@ class IndirectionSensUnionFindAA {
   }
 
   void onAddValue(ByConstRef<v_t> /*Var*/, ValueId VId) {
+    assert(size_t(VId) == Var2Obj.size() && "Expect ascending VIds");
     auto Obj = Obj2Var.size();
     Base.AliasSets.grow(Obj + K);
     Var2Obj.emplace_back(generate_tag, [Obj](IndDepth Depth) {
diff --git a/include/phasar/Utils/Macros.h b/include/phasar/Utils/Macros.h
index 519d3e7a21..b76c8b9986 100644
--- a/include/phasar/Utils/Macros.h
+++ b/include/phasar/Utils/Macros.h
@@ -32,7 +32,7 @@
 
 #if __has_cpp_attribute(clang::lifetimebound)
 #define PSR_LIFETIMEBOUND [[clang::lifetimebound]]
-#elif __has_cpp_attribute([[lifetimebound]])
+#elif __has_cpp_attribute(lifetimebound)
 #define PSR_LIFETIMEBOUND [[lifetimebound]]
 #else
 #define PSR_LIFETIMEBOUND
diff --git a/include/phasar/Utils/MaybeUniquePtr.h b/include/phasar/Utils/MaybeUniquePtr.h
index 7ad6d12155..06625f1fa0 100644
--- a/include/phasar/Utils/MaybeUniquePtr.h
+++ b/include/phasar/Utils/MaybeUniquePtr.h
@@ -10,6 +10,8 @@
 #ifndef PHASAR_UTILS_MAYBEUNIQUEPTR_H_
 #define PHASAR_UTILS_MAYBEUNIQUEPTR_H_
 
+#include "phasar/Utils/Macros.h"
+
 #include "llvm/ADT/PointerIntPair.h"
 #include "llvm/Support/PointerLikeTypeTraits.h"
 
@@ -68,7 +70,8 @@ class [[clang::trivial_abi]] MaybeUniquePtr
 public:
   constexpr MaybeUniquePtr() noexcept = default;
 
-  constexpr MaybeUniquePtr(T *Pointer, bool Owns = false) noexcept
+  constexpr MaybeUniquePtr(T *Pointer PSR_LIFETIMEBOUND,
+                           bool Owns = false) noexcept
       : detail::MaybeUniquePtrBase<T, RequireAlignment>(Pointer,
                                                         Owns && Pointer) {}
 
diff --git a/include/phasar/Utils/NonNullPtr.h b/include/phasar/Utils/NonNullPtr.h
index 0a978a5ede..e3f7dff0ec 100644
--- a/include/phasar/Utils/NonNullPtr.h
+++ b/include/phasar/Utils/NonNullPtr.h
@@ -9,6 +9,7 @@
  *     Fabian Schiebel and others
  *****************************************************************************/
 
+#include "phasar/Utils/Macros.h"
 #include "phasar/Utils/Utilities.h"
 
 #include "llvm/Support/Compiler.h"
@@ -23,14 +24,16 @@ class [[gsl::Pointer(T)]] NonNullPtr : public std::reference_wrapper<T> {
 public:
   constexpr NonNullPtr(std::nullptr_t) = delete;
 
-  LLVM_ATTRIBUTE_ALWAYS_INLINE constexpr NonNullPtr(T *Ptr) noexcept
+  LLVM_ATTRIBUTE_ALWAYS_INLINE constexpr NonNullPtr(
+      T *Ptr PSR_LIFETIMEBOUND) noexcept
       : std::reference_wrapper<T>(psr::assertNotNull(Ptr)) {}
 
   LLVM_ATTRIBUTE_ALWAYS_INLINE constexpr NonNullPtr(
-      std::reference_wrapper<T> RW) noexcept
+      std::reference_wrapper<T> RW PSR_LIFETIMEBOUND) noexcept
       : std::reference_wrapper<T>(RW) {}
 
-  LLVM_ATTRIBUTE_ALWAYS_INLINE explicit constexpr NonNullPtr(T &Ref) noexcept
+  LLVM_ATTRIBUTE_ALWAYS_INLINE explicit constexpr NonNullPtr(
+      T &Ref PSR_LIFETIMEBOUND) noexcept
       : std::reference_wrapper<T>(Ref) {}
 
   template <typename U>
diff --git a/include/phasar/Utils/SparseBitSet.h b/include/phasar/Utils/SparseBitSet.h
new file mode 100644
index 0000000000..f09a0d151b
--- /dev/null
+++ b/include/phasar/Utils/SparseBitSet.h
@@ -0,0 +1,155 @@
+#pragma once
+
+/******************************************************************************
+ * Copyright (c) 2026 Fabian Schiebel.
+ * All rights reserved. This program and the accompanying materials are made
+ * available under the terms of LICENSE.txt.
+ *
+ * Contributors:
+ *     Fabian Schiebel and others
+ *****************************************************************************/
+
+#include "phasar/Utils/TypeTraits.h"
+#include "phasar/Utils/Utilities.h"
+
+#include "llvm/ADT/ArrayRef.h"
+
+#include "roaring/roaring.hh"
+
+#include <functional>
+
+namespace psr {
+
+/// Thin wrapper over a Roaring bitmap, providing an API conforming to the
+/// IsRawAliasSet concept.
+template <SmallIdType IdT> class SparseBitSet {
+public:
+  using value_type = IdT;
+
+  SparseBitSet() = default;
+
+  void insert(IdT Id) { Bits.add(uint32_t(Id)); }
+
+  [[nodiscard]] bool tryInsert(IdT Id) { return Bits.addChecked(uint32_t(Id)); }
+
+  [[nodiscard]] bool contains(IdT Id) const {
+    return Bits.contains(uint32_t(Id));
+  }
+
+  template <std::invocable<IdT> HandlerFn>
+  LLVM_ATTRIBUTE_ALWAYS_INLINE void foreach (HandlerFn Handler) const {
+    return Bits.iterate(
+        [](uint32_t Id, void *HandlerPtr) {
+          auto &Handler = *(HandlerFn *)HandlerPtr;
+          if constexpr (std::convertible_to<
+                            std::invoke_result_t<HandlerFn &, IdT>, bool>) {
+            if (!std::invoke(Handler, IdT(Id))) {
+              return false;
+            }
+          } else {
+            std::invoke(Handler, IdT(Id));
+          }
+          return true;
+        },
+        &Handler);
+  }
+
+  void operator|=(const SparseBitSet &Other) { Bits |= Other.Bits; }
+  void operator&=(const SparseBitSet &Other) { Bits &= Other.Bits; }
+  void operator-=(const SparseBitSet &Other) { Bits -= Other.Bits; }
+  [[nodiscard]] SparseBitSet operator-(const SparseBitSet &Other) const {
+    return Bits - Other.Bits;
+  }
+
+  [[nodiscard]] bool empty() const noexcept { return Bits.isEmpty(); }
+  [[nodiscard]] size_t size() const noexcept { return Bits.cardinality(); }
+
+  void clear() noexcept { Bits.clear(); }
+
+  [[nodiscard]] auto begin() const noexcept { return Bits.begin(); }
+  [[nodiscard]] auto end() const noexcept { return Bits.end(); }
+
+  [[nodiscard]] bool tryMergeWith(const SparseBitSet &Other) {
+    auto OldSz = size();
+    Bits |= Other.Bits;
+    return size() != OldSz;
+  }
+
+  void erase(IdT Id) { Bits.remove(uint32_t(Id)); }
+
+  // Bulk-inserts from a sorted, deduplicated array.
+  // Roaring constructs containers in O(N) for sorted input.
+  void insertSorted(llvm::ArrayRef<uint32_t> Sorted) {
+    Bits.addMany(Sorted.size(), Sorted.data());
+  }
+
+  [[nodiscard]] bool operator==(const SparseBitSet &Other) const noexcept {
+    return Bits == Other.Bits;
+  }
+
+  bool mergeWithDiff(const SparseBitSet &Other,
+                     std::invocable<IdT> auto WithNewElem) {
+    constexpr size_t DiffThreshold = 16;
+    // operator- is expensive, but it is definitely a lot faster than the
+    // foreach loop if Other is large
+
+    if (Other.size() > DiffThreshold) {
+      SparseBitSet Diff = Other - *this;
+      if (Diff.empty()) {
+        return false;
+      }
+
+      *this |= Diff;
+
+      Diff.foreach (copyOrRef(WithNewElem));
+      return true;
+    }
+
+    bool Ret = false;
+    Other.foreach ([&](IdT Elem) {
+      if (tryInsert(Elem)) {
+        std::invoke(WithNewElem, Elem);
+        Ret = true;
+      }
+    });
+    return Ret;
+  }
+
+  bool mergeWithDiff(const SparseBitSet &Other,
+                     std::invocable<IdT> auto WithNewElem,
+                     SparseBitSet &IntoDiff) {
+    constexpr size_t DiffThreshold = 16;
+    // operator- is expensive, but it is definitely a lot faster than the
+    // foreach loop if Other is large
+
+    if (Other.size() > DiffThreshold) {
+      SparseBitSet Diff = Other - *this;
+      if (Diff.empty()) {
+        return false;
+      }
+
+      *this |= Diff;
+      IntoDiff |= Diff;
+
+      Diff.foreach (copyOrRef(WithNewElem));
+      return true;
+    }
+
+    bool Ret = false;
+    Other.foreach ([&](IdT Elem) {
+      if (tryInsert(Elem)) {
+        IntoDiff.insert(Elem);
+        std::invoke(WithNewElem, Elem);
+        Ret = true;
+      }
+    });
+
+    return Ret;
+  }
+
+private:
+  SparseBitSet(roaring::Roaring &&RR) : Bits(std::move(RR)) {}
+
+  roaring::Roaring Bits{};
+};
+} // namespace psr
diff --git a/include/phasar/Utils/TypeTraits.h b/include/phasar/Utils/TypeTraits.h
index 403b8cc912..158a072ba7 100644
--- a/include/phasar/Utils/TypeTraits.h
+++ b/include/phasar/Utils/TypeTraits.h
@@ -104,7 +104,7 @@ concept is_iterable_v = requires(T &Val) {
 
 template <typename T, typename Over>
 concept is_iterable_over_v = is_iterable_v<T> && requires(T &Val) {
-  { *llvm::adl_begin(Val) } -> same_as_decay<Over>;
+  { *llvm::adl_begin(Val) } -> std::convertible_to<Over>;
 };
 
 template <typename T>
diff --git a/lib/PhasarLLVM/DB/LLVMProjectIRDB.cpp b/lib/PhasarLLVM/DB/LLVMProjectIRDB.cpp
index a44aa6a360..120cbe73f0 100644
--- a/lib/PhasarLLVM/DB/LLVMProjectIRDB.cpp
+++ b/lib/PhasarLLVM/DB/LLVMProjectIRDB.cpp
@@ -328,16 +328,15 @@ void LLVMProjectIRDB::insertFunction(llvm::Function *F, bool DoPreprocessing) {
 
   auto &Context = F->getContext();
   for (auto &Inst : llvm::instructions(F)) {
-    if (DoPreprocessing) {
-      llvm::MDNode *Node = llvm::MDNode::get(
-          Context, llvm::MDString::get(Context, std::to_string(Id)));
-      Inst.setMetadata(PhasarConfig::MetaDataKind(), Node);
+    if (InstToId.try_emplace(&Inst, Id).second) {
+      if (DoPreprocessing) {
+        llvm::MDNode *Node = llvm::MDNode::get(
+            Context, llvm::MDString::get(Context, std::to_string(Id)));
+        Inst.setMetadata(PhasarConfig::MetaDataKind(), Node);
+      }
+      IdToInst.push_back(&Inst);
+      ++Id;
     }
-
-    IdToInst.push_back(&Inst);
-    InstToId.try_emplace(&Inst, Id);
-
-    ++Id;
   }
   assert(InstToId.size() == IdToInst.size());
 }
diff --git a/lib/PhasarLLVM/HelperAnalyses.cpp b/lib/PhasarLLVM/HelperAnalyses.cpp
index 88dc1c47bb..9f5323caa2 100644
--- a/lib/PhasarLLVM/HelperAnalyses.cpp
+++ b/lib/PhasarLLVM/HelperAnalyses.cpp
@@ -4,16 +4,23 @@
 #include "phasar/DataFlow/HelperAnalyses.h"
 #include "phasar/PhasarLLVM/ControlFlow/EntryFunctionUtils.h"
 #include "phasar/PhasarLLVM/ControlFlow/FunctionCompressor.h"
+#include "phasar/PhasarLLVM/ControlFlow/GlobalCtorsDtorsModel.h"
 #include "phasar/PhasarLLVM/ControlFlow/LLVMBasedCallGraphBuilder.h"
 #include "phasar/PhasarLLVM/ControlFlow/LLVMBasedICFG.h"
 #include "phasar/PhasarLLVM/ControlFlow/Resolver/RTAResolver.h"
 #include "phasar/PhasarLLVM/DB/LLVMProjectIRDB.h"
+#include "phasar/PhasarLLVM/Pointer/AndersenOTFAA.h"
+#include "phasar/PhasarLLVM/Pointer/LLVMAliasInfo.h"
 #include "phasar/PhasarLLVM/Pointer/LLVMAliasSet.h"
 #include "phasar/PhasarLLVM/Pointer/LLVMAliasSetData.h"
+#include "phasar/PhasarLLVM/Pointer/LLVMPointerAssignmentGraph.h"
+#include "phasar/PhasarLLVM/Pointer/LLVMRawAliasSet.h"
 #include "phasar/PhasarLLVM/Pointer/LLVMUnionFindAliasSet.h"
 #include "phasar/PhasarLLVM/TypeHierarchy/DIBasedTypeHierarchy.h"
 #include "phasar/PhasarLLVM/Utils/UsedGlobals.h"
 #include "phasar/Pointer/AliasAnalysisType.h"
+#include "phasar/Utils/AnalysisProperties.h"
+#include "phasar/Utils/ValueCompressor.h"
 
 #include <memory>
 #include <string>
@@ -88,6 +95,11 @@ LLVMProjectIRDB &HelperAnalyses::getProjectIRDB() {
   if (!IRDB) {
     IRDB = std::make_unique<LLVMProjectIRDB>(IRFile);
   }
+  if (AutoGlobalSupport) {
+    AutoGlobalSupport = false;
+    GlobalCtorsDtorsModel::buildModel(*IRDB, EntryPoints);
+    EntryPoints = {GlobalCtorsDtorsModel::ModelName.str()};
+  }
   return *IRDB;
 }
 
@@ -107,6 +119,30 @@ LLVMAliasInfoRef HelperAnalyses::getAliasInfo() {
               .AType = UFAATy,
               .ALocality = LLVMUnionFindAliasSet::AnalysisLocality::Global,
           });
+    } else if (isAndersenOTFAA(PTATy)) {
+      auto &IRDB = getProjectIRDB();
+      auto VC = std::make_unique<ValueCompressor<PAGVariable>>();
+      auto AARes = computeAndersenOTFRaw(
+          IRDB, getEntryFunctions(IRDB, EntryPoints), VC.get(), SoundnessLevel,
+          {.SelectionMode = [PTATy{PTATy}] {
+            if (PTATy == AliasAnalysisType::AndersenOTFCtx) {
+              return ContextSensitivityOptions::Mode::All;
+            }
+            if (PTATy == AliasAnalysisType::AndersenOTFDynCtx) {
+              return ContextSensitivityOptions::Mode::Dynamic;
+            }
+            return ContextSensitivityOptions::Mode::Off;
+          }()});
+
+      if (!ICF) {
+        ICF = std::make_unique<LLVMBasedICFG>(std::move(AARes.CG), &IRDB);
+      }
+
+      PT = std::make_unique<LLVMRawAliasSet>(
+          std::move(AARes), std::move(VC),
+          PTATy != AliasAnalysisType::AndersenOTF
+              ? AnalysisProperties::ContextSensitive
+              : AnalysisProperties::None);
     } else {
       PT = std::make_unique<LLVMAliasSet>(&getProjectIRDB(), AllowLazyPTS,
                                           PTATy);
@@ -127,10 +163,15 @@ LLVMBasedICFG &HelperAnalyses::getICFG() {
     if (PrecomputedCG.has_value()) {
       ICF = std::make_unique<LLVMBasedICFG>(&getProjectIRDB(), *PrecomputedCG);
     } else {
-      ICF = std::make_unique<LLVMBasedICFG>(
-          &getProjectIRDB(), CGTy, std::move(EntryPoints), &getTypeHierarchy(),
-          needsAliasInfo(CGTy) ? getAliasInfo() : nullptr, SoundnessLevel,
-          AutoGlobalSupport);
+
+      LLVMAliasInfoRef AI = needsAliasInfo(CGTy) ? getAliasInfo() : nullptr;
+      // getAliasInfo() may compute the call-graph already (e.g., AndersenOTFAA)
+      if (!ICF) {
+        // Note: AutoGlobals already handled in getProjectIRDB()
+        ICF = std::make_unique<LLVMBasedICFG>(
+            &getProjectIRDB(), CGTy, EntryPoints, &getTypeHierarchy(), AI,
+            SoundnessLevel, /*IncludeGlobals*/ false);
+      }
     }
   }
 
diff --git a/lib/PhasarLLVM/Pointer/AndersenOTFAA.cpp b/lib/PhasarLLVM/Pointer/AndersenOTFAA.cpp
index 8de2f4e879..28872793a0 100644
--- a/lib/PhasarLLVM/Pointer/AndersenOTFAA.cpp
+++ b/lib/PhasarLLVM/Pointer/AndersenOTFAA.cpp
@@ -12,16 +12,20 @@
 #include "phasar/PhasarLLVM/DB/LLVMProjectIRDB.h"
 #include "phasar/PhasarLLVM/Pointer/LLVMGlobalInitCache.h"
 #include "phasar/PhasarLLVM/Pointer/LLVMPointerAssignmentGraph.h"
+#include "phasar/PhasarLLVM/Pointer/LLVMPointerSemantics.h"
 #include "phasar/PhasarLLVM/Pointer/MemSSAUtils.h"
 #include "phasar/PhasarLLVM/TypeHierarchy/DIBasedTypeHierarchy.h"
 #include "phasar/PhasarLLVM/TypeHierarchy/LLVMVFTable.h"
 #include "phasar/PhasarLLVM/Utils/LLVMFunctionDataFlowFacts.h"
 #include "phasar/PhasarLLVM/Utils/LLVMShorthands.h"
 #include "phasar/PhasarLLVM/Utils/VirtualCallUtils.h"
+#include "phasar/Pointer/CallingContextConstructor.h"
+#include "phasar/Utils/Compressor.h"
 #include "phasar/Utils/IotaIterator.h"
 #include "phasar/Utils/LibCSummary.h"
 #include "phasar/Utils/LibrarySummary.h"
 #include "phasar/Utils/Soundness.h"
+#include "phasar/Utils/TypedVector.h"
 #include "phasar/Utils/UnionFind.h"
 #include "phasar/Utils/Utilities.h"
 #include "phasar/Utils/ValueCompressor.h"
@@ -33,6 +37,7 @@
 #include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/SmallPtrSet.h"
 #include "llvm/ADT/SmallVector.h"
+#include "llvm/ADT/StringRef.h"
 #include "llvm/Analysis/MemorySSA.h"
 #include "llvm/Analysis/TargetLibraryInfo.h"
 #include "llvm/IR/Constants.h"
@@ -44,7 +49,10 @@
 #include "llvm/IR/Instructions.h"
 #include "llvm/IR/IntrinsicInst.h"
 #include "llvm/Support/Casting.h"
+#include "llvm/Support/Error.h"
 #include "llvm/Support/ErrorHandling.h"
+#include "llvm/Support/GlobPattern.h"
+#include "llvm/Support/raw_ostream.h"
 
 #include <cassert>
 #include <memory>
@@ -79,15 +87,44 @@ class AndersenVar {
   llvm::PointerIntPair<PAGVariable, 1, bool> Base{};
 };
 
+/// A PAG node of a context-sensitively analyzed function: the plain node
+/// identity plus the calling context it belongs to.
+struct ContextualVar {
+  AndersenVar Var;
+  CallingContextId Ctx{};
+
+  friend bool operator==(ContextualVar A, ContextualVar B) noexcept {
+    return A.Var == B.Var && A.Ctx == B.Ctx;
+  }
+
+  friend auto hash_value(ContextualVar V) noexcept {
+    return llvm::hash_combine(hash_value(V.Var), uint32_t(V.Ctx));
+  }
+};
+
+/// An allocation-site object, qualified by the context it was allocated in.
+struct ObjectKey {
+  const llvm::Value *Val = nullptr;
+  CallingContextId Ctx{};
+
+  friend bool operator==(ObjectKey A, ObjectKey B) noexcept {
+    return A.Val == B.Val && A.Ctx == B.Ctx;
+  }
+
+  friend auto hash_value(ObjectKey K) noexcept {
+    return llvm::hash_combine(K.Val, uint32_t(K.Ctx));
+  }
+};
+
 /// Key for FnPtrFieldWrites: an allocation-site object + constant GEP
 /// index sequence.
 struct FieldWriteKey {
-  const llvm::Value *Val = nullptr;
+  ObjectKey Obj;
   llvm::SmallVector<uint64_t, 3> Indices;
 
   friend bool operator==(const FieldWriteKey &A,
                          const FieldWriteKey &B) noexcept {
-    return A.Val == B.Val && A.Indices == B.Indices;
+    return A.Obj == B.Obj && A.Indices == B.Indices;
   }
 };
 } // namespace
@@ -104,16 +141,42 @@ template <> struct DenseMapInfo<AndersenVar> {
   static bool isEqual(AndersenVar A, AndersenVar B) noexcept { return A == B; }
 };
 
+template <> struct DenseMapInfo<ContextualVar> {
+  static ContextualVar getEmptyKey() noexcept {
+    return {DenseMapInfo<AndersenVar>::getEmptyKey(), {}};
+  }
+  static ContextualVar getTombstoneKey() noexcept {
+    return {DenseMapInfo<AndersenVar>::getTombstoneKey(), {}};
+  }
+  static unsigned getHashValue(ContextualVar V) noexcept {
+    return hash_value(V);
+  }
+  static bool isEqual(ContextualVar A, ContextualVar B) noexcept {
+    return A == B;
+  }
+};
+
+template <> struct DenseMapInfo<ObjectKey> {
+  static ObjectKey getEmptyKey() noexcept {
+    return {DenseMapInfo<const Value *>::getEmptyKey(), {}};
+  }
+  static ObjectKey getTombstoneKey() noexcept {
+    return {DenseMapInfo<const Value *>::getTombstoneKey(), {}};
+  }
+  static unsigned getHashValue(ObjectKey K) noexcept { return hash_value(K); }
+  static bool isEqual(ObjectKey A, ObjectKey B) noexcept { return A == B; }
+};
+
 template <> struct DenseMapInfo<FieldWriteKey> {
   static FieldWriteKey getEmptyKey() noexcept {
-    return {DenseMapInfo<const Value *>::getEmptyKey(), {}};
+    return {DenseMapInfo<ObjectKey>::getEmptyKey(), {}};
   }
   static FieldWriteKey getTombstoneKey() noexcept {
-    return {DenseMapInfo<const Value *>::getTombstoneKey(), {}};
+    return {DenseMapInfo<ObjectKey>::getTombstoneKey(), {}};
   }
   static unsigned getHashValue(const FieldWriteKey &K) noexcept {
     auto H1 = llvm::hash_combine_range(K.Indices.begin(), K.Indices.end());
-    return llvm::hash_combine(H1, K.Val);
+    return llvm::hash_combine(H1, hash_value(K.Obj));
   }
   static bool isEqual(const FieldWriteKey &A, const FieldWriteKey &B) noexcept {
     return A == B;
@@ -121,6 +184,61 @@ template <> struct DenseMapInfo<FieldWriteKey> {
 };
 } // namespace llvm
 
+namespace {
+/// The k-limited call-string used as calling context; k is fixed at 1.
+using CallCtx = CallingContext<const llvm::CallBase *, 1>;
+
+/// A function analyzed under one particular calling context.
+using FuncCtx = std::pair<const llvm::Function *, CallingContextId>;
+
+/// Interning table for the PAG nodes of context-sensitively analyzed
+/// functions.  Node ids are *not* allocated here but carved out of the
+/// solver's shared ValueId space, so points-to sets, assignment edges and the
+/// union-find stay single-typed and never learn about contexts.
+///
+/// Stays empty -- and costs nothing -- while context-sensitivity is off.
+class ContextualNodeTable {
+public:
+  /// Id of \p CV, allocating a fresh one via \p AllocId on first use.
+  ValueId getOrInsert(ContextualVar CV, auto &&AllocId) {
+    auto [It, Inserted] = Var2Id.try_emplace(CV, ValueId{});
+    if (Inserted) {
+      It->second = AllocId();
+      recordVar(It->second, CV);
+    }
+    return It->second;
+  }
+
+  /// Registers \p CV as an additional name for the existing node \p Id.
+  /// \returns the id \p CV maps to afterwards -- \p Id, or the id it was
+  /// already bound to, in which case no alias was recorded.
+  ValueId addAlias(ContextualVar CV, ValueId Id) {
+    auto [It, Inserted] = Var2Id.try_emplace(CV, Id);
+    if (Inserted) {
+      recordVar(Id, CV);
+    }
+    return It->second;
+  }
+
+  /// All context-qualified names of node \p Id; empty for plain nodes.
+  [[nodiscard]] llvm::ArrayRef<ContextualVar> vars(ValueId Id) const noexcept {
+    return Id2Vars.inbounds(Id) ? llvm::ArrayRef<ContextualVar>(Id2Vars[Id])
+                                : llvm::ArrayRef<ContextualVar>{};
+  }
+
+private:
+  void recordVar(ValueId Id, ContextualVar CV) {
+    if (!Id2Vars.inbounds(Id)) {
+      Id2Vars.resize(size_t(Id) + 1);
+    }
+    Id2Vars[Id].push_back(CV);
+  }
+
+  llvm::DenseMap<ContextualVar, ValueId> Var2Id;
+  TypedVector<ValueId, llvm::SmallVector<ContextualVar, 1>> Id2Vars;
+};
+} // namespace
+
 struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
   // ---- Per-node state -------------------------------------------------
 
@@ -152,6 +270,7 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
     ValueId FPId;
     ArgList Args;
     std::optional<ValueId> CSRetVal;
+    CallingContextId Ctx; // context of the calling function
   };
 
   struct VCallRecord {
@@ -160,6 +279,7 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
     uint64_t VtableIndex;
     ArgList Args;
     std::optional<ValueId> CSRetVal;
+    CallingContextId Ctx;
   };
 
   struct StructVCallRecord {
@@ -170,6 +290,7 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
     llvm::Type *GEPElemTy; // GEP source element type (for type check)
     ArgList Args;
     std::optional<ValueId> CSRetVal;
+    CallingContextId Ctx;
   };
 
   struct QualifyingFieldWriteRecord {
@@ -187,8 +308,9 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
 
   // ---- Data fields ----------------------------------------------------
 
-  const LLVMProjectIRDB &IRDB;              // NOLINT
-  const llvm::DataLayout &DL;               // NOLINT
+  const LLVMProjectIRDB &IRDB; // NOLINT
+  const llvm::DataLayout &DL;  // NOLINT
+  PunnedABICache PunnedABI{&DL};
   ValueCompressor<PAGVariable> &ExternalVC; // NOLINT – caller-visible output
   ValueCompressor<AndersenVar> LocalVC{};   // internal variable+object nodes
   Soundness SoundnessFlag;
@@ -196,18 +318,17 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
 
   llvm::TargetLibraryInfoWrapperPass TLA{};
   // Per-function MemSSA cache: shared between processFunction() (which needs
-  // the MemorySSA of whichever function is currently being translated) and
-  // the allocation-wrapper classifier (which needs the MemorySSA of an
-  // arbitrary callee at classification time). Building at most once per
-  // function avoids redundant dominator-tree/AA construction for functions
-  // that are both classified and later processed.
+  // the MemorySSA of currently translated function) and the allocation-wrapper
+  // classifier (which needs the MemorySSA of an arbitrary callee at
+  // classification time). Building at most once per function avoids redundant
+  // dominator-tree/AA construction for functions that are both classified and
+  // later processed.
   llvm::DenseMap<const llvm::Function *, std::unique_ptr<MemSSABundle>>
       MemSSACache;
   llvm::MemorySSA *CurrentMemSSA = nullptr;
 
-  llvm::SmallVector<const llvm::Function *, 8> FunctionWorklist;
-  llvm::DenseSet<const llvm::Function *> Queued; // ever pushed to worklist
-  llvm::DenseSet<const llvm::Function *> Processed;
+  llvm::SmallVector<FuncCtx, 8> FunctionWorklist;
+  llvm::DenseSet<FuncCtx> Queued; // ever pushed to worklist
 
   UnionFind<ValueId> SCCUf;
   TypedVector<ValueId, NodeInfo> Nodes;
@@ -215,6 +336,9 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
   llvm::SmallVector<FPCallRecord> UnresolvedFPCalls;
   llvm::SmallVector<VCallRecord> UnresolvedVCalls;
   llvm::SmallVector<StructVCallRecord> UnresolvedStructVCalls;
+  // Argument lists of calls to declarations, whose fn-ptr arguments are
+  // treated as reachable callbacks; see checkUnresolvedCallbacks().
+  llvm::SmallVector<ArgList> UnresolvedCallbacks;
 
   // Observed fn-ptr field writes for heap/stack dispatch tables.
   struct FieldWriteInfo {
@@ -224,34 +348,69 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
   llvm::DenseMap<FieldWriteKey, FieldWriteInfo> FnPtrFieldWrites;
   // Reverse index: all Indices tracked for a given object, so a memcpy can
   // enumerate "every known field" of its source object (see CopyForward).
-  llvm::DenseMap<const llvm::Value *,
+  llvm::DenseMap<ObjectKey,
                  llvm::SmallVector<llvm::SmallVector<uint64_t, 3>, 2>>
       FieldsByObject;
   // Objects with an untrusted write; FnPtrFieldWrites is ignored for these.
-  llvm::DenseSet<const llvm::Value *> ImpureObjects;
-  llvm::SmallVector<ValueId> UnresolvedPoisenFieldWrites;
+  llvm::DenseSet<ObjectKey> ImpureObjects;
+  llvm::SmallVector<ValueId> UnresolvedPoisonFieldWrites;
   llvm::SmallVector<QualifyingFieldWriteRecord> UnresolvedQualFieldWrites;
   llvm::SmallVector<CopyForwardFieldWriteRecord> UnresolvedCopyFieldWrites;
-  llvm::DenseMap<const llvm::CallBase *, llvm::SmallDenseSet<ValueId, 4>>
+  // Per (call-site, caller-context): the (callee node, callee context) pairs
+  // already wired up.  One call site reached from several contexts must bind
+  // its actuals once per context, hence the context in both key and value.
+  // The value packs the callee's ValueId rather than its Function *, halving
+  // the element to 8 bytes -- that is why connectCallee interns a node for
+  // every direct callee.
+  llvm::DenseMap<std::pair<const llvm::CallBase *, CallingContextId>,
+                 llvm::SmallDenseSet<uint64_t, 4>>
       ConnectedCallees;
   CallGraphBuilder<const llvm::Instruction *, const llvm::Function *> CGBuilder;
   llvm::SmallVector<ValueId, 64> PropWorklist;
 
+  // ---- Context-sensitivity --------------------------------------------
+
+  ContextSensitivityOptions CSOpts;
+  llvm::SmallVector<llvm::GlobPattern, 0> AllowPatterns;
+  llvm::SmallVector<llvm::GlobPattern, 0> DenyPatterns;
+  Compressor<CallCtx, CallingContextId> Contexts;
+  ContextualNodeTable CtxNodes;
+  llvm::DenseMap<const llvm::Function *, bool> SelectedCache;
+  // Subset of SelectedCache selected by AllowList; exempt from the budget.
+  llvm::DenseSet<const llvm::Function *> AllowListed;
+  llvm::DenseMap<const llvm::Function *, unsigned> CallSiteCounts;
+  // Contexts already instantiated per selected function; see calleeContext().
+  llvm::DenseMap<const llvm::Function *,
+                 llvm::SmallDenseSet<CallingContextId, 4>>
+      ContextsPerFn;
+  size_t NumContextualNodes = 0;
+  bool BudgetExhausted = false;
+  // The function/context currently being translated by processFunction().
+  const llvm::Function *CurFunc = nullptr;
+  CallingContextId CurCtx = CallingContextId::None;
+
   // ---- Constructor ----------------------------------------------------
 
   SolverData(const LLVMProjectIRDB &IRDB,
              llvm::ArrayRef<const llvm::Function *> Entries,
-             ValueCompressor<PAGVariable> &VC, Soundness S)
+             ValueCompressor<PAGVariable> &VC, Soundness S,
+             ContextSensitivityOptions CSOpts)
       : IRDB(IRDB), DL(IRDB.getModule()->getDataLayout()), ExternalVC(VC),
-        SoundnessFlag(S), LibFacts(library_summary::readFromFDFF(
-                              getLibCSummary(), [&IRDB](llvm::StringRef Name) {
-                                return IRDB.getFunction(Name);
-                              })) {
+        SoundnessFlag(S),
+        LibFacts(library_summary::readFromFDFF(
+            getLibCSummary(),
+            [&IRDB](llvm::StringRef Name) { return IRDB.getFunction(Name); })),
+        CSOpts(std::move(CSOpts)) {
+
+    // Id 0 == CallingContextId::None is the root (context-insensitive) context.
+    std::ignore = Contexts.getOrInsert(CallCtx{});
+    AllowPatterns = compileGlobs(this->CSOpts.AllowList, "allow-list");
+    DenyPatterns = compileGlobs(this->CSOpts.DenyList, "deny-list");
 
     CGBuilder.reserve(IRDB.getNumFunctions());
     for (const auto *F : Entries) {
-      if (Queued.insert(F).second) {
-        FunctionWorklist.push_back(F);
+      if (Queued.insert({F, CallingContextId::None}).second) {
+        FunctionWorklist.emplace_back(F, CallingContextId::None);
 
         // entry functions may be missed in the CG, if they are never called
         // explicitly in the code
@@ -271,6 +430,25 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
     }
   }
 
+  /// Compiles the glob patterns of the context-selection list \p ListName.
+  /// Invalid patterns are skipped, but reported: dropping them silently would
+  /// disable selection for exactly the functions the user asked for.
+  static llvm::SmallVector<llvm::GlobPattern, 0>
+  compileGlobs(llvm::ArrayRef<std::string> Patterns, llvm::StringRef ListName) {
+    llvm::SmallVector<llvm::GlobPattern, 0> Ret;
+    Ret.reserve(Patterns.size());
+    for (const auto &Pat : Patterns) {
+      if (auto Glob = llvm::GlobPattern::create(Pat)) {
+        Ret.push_back(std::move(*Glob));
+      } else {
+        llvm::errs() << "[WARNING]: Ignoring invalid " << ListName
+                     << " pattern '" << Pat
+                     << "': " << llvm::toString(Glob.takeError()) << '\n';
+      }
+    }
+    return Ret;
+  }
+
   // ---- Node growth ----------------------------------------------------
 
   void grow(ValueId V) {
@@ -281,16 +459,52 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
     }
   }
 
-  ValueId getOrInsertVar(PAGVariable Var) {
-    auto [Id, _] = LocalVC.insert(AndersenVar{Var, false});
+  // The context a node of \p Var belongs to while translating CurFunc.
+  // Globals, constants and values of other functions always stay in the root
+  // context.
+  [[nodiscard]] CallingContextId contextOf(PAGVariable Var) const noexcept {
+    if (CurCtx == CallingContextId::None) {
+      return CallingContextId::None;
+    }
+    return Var.getFunction() == CurFunc ? CurCtx : CallingContextId::None;
+  }
+
+  ValueId getOrInsertNode(AndersenVar Var, CallingContextId Ctx) {
+    const ValueId Id =
+        Ctx == CallingContextId::None
+            ? LocalVC.insert(Var).first
+            : CtxNodes.getOrInsert({.Var = Var, .Ctx = Ctx}, [this] {
+                ++NumContextualNodes;
+                return LocalVC.addDummy();
+              });
     grow(Id);
     return Id;
   }
 
+  ValueId getOrInsertVar(PAGVariable Var) {
+    return getOrInsertNode(AndersenVar{Var, false}, contextOf(Var));
+  }
+  ValueId getOrInsertVar(PAGVariable Var, CallingContextId Ctx) {
+    return getOrInsertNode(AndersenVar{Var, false}, Ctx);
+  }
+
   ValueId getOrInsertObj(PAGVariable Var) {
-    auto [Id, _] = LocalVC.insert(AndersenVar{Var, true});
-    grow(Id);
-    return Id;
+    return getOrInsertNode(AndersenVar{Var, true}, contextOf(Var));
+  }
+  ValueId getOrInsertObj(PAGVariable Var, CallingContextId Ctx) {
+    return getOrInsertNode(AndersenVar{Var, true}, Ctx);
+  }
+
+  // Visits every (base var, context) behind node \p Id.  A single id can carry
+  // both plain and context-qualified names, since addAlias() merges GEP/cast
+  // results into their base pointer's node.
+  void forEachVar(ValueId Id, std::invocable<ContextualVar> auto Fn) const {
+    for (const auto &Var : LocalVC.id2vars(Id)) {
+      std::invoke(Fn, ContextualVar{.Var = Var, .Ctx = {}});
+    }
+    for (const auto &CVar : CtxNodes.vars(Id)) {
+      std::invoke(Fn, CVar);
+    }
   }
 
   // pts(VarId) for global objects: functions self-point (the address IS
@@ -388,14 +602,24 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
     }
 
     Nodes[NonRep] = NodeInfo{};
+
+    // The pts merge above may have left a pending wave that no addAssignEdge
+    // queued: it re-marks Rep's pts only when that pts is non-empty, so an
+    // empty Rep absorbing a non-empty NonRep strands the whole diff.
+    if (!Nodes[Rep].PendingPts.empty()) {
+      PropWorklist.push_back(Rep);
+    }
     return Rep;
   }
 
   // ---- Operand traversal ----------------------------------------------
 
-  void forEachOpId(const llvm::Value *V, std::invocable<ValueId> auto Handler) {
+  // \p Punned suppresses the no-pointer early-out, for values whose integer
+  // type hides a pointer (see isPunnedPointerAccess).
+  void forEachOpId(const llvm::Value *V, std::invocable<ValueId> auto Handler,
+                   bool Punned = false) {
     const llvm::Value *Stripped = V->stripPointerCastsAndAliases();
-    if (definitelyContainsNoPointer(Stripped)) {
+    if (!Punned && definitelyContainsNoPointer(Stripped)) {
       return;
     }
     psr::forEachPointerOperand(
@@ -416,9 +640,13 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
   // across a grow() call.  addAssignEdge does not call grow(), so references
   // into Nodes remain valid across it.
 
+  // NOTE: \p Obj is stored as-is, *not* resolved through rep(). Pts-set
+  // membership is what defines may-alias, so letting SCC collapsing rewrite an
+  // object's identity would conflate distinct abstract objects for good. Cycle
+  // collapsing still drives propagation: every constraint helper reached from a
+  // pts element re-resolves through rep() itself.
   void addPointee(ValueId Ptr, ValueId Obj) {
     Ptr = rep(Ptr);
-    Obj = rep(Obj);
     grow(Ptr);
     grow(Obj); // grow before indexing Nodes[Ptr]
     if (Nodes[Ptr].PtsSet.tryInsert(Obj)) {
@@ -601,22 +829,48 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
     return *Bundle;
   }
 
-  void processFunction(const llvm::Function *F) {
+  // Translates F's body once per calling context: nodes created here are
+  // qualified by Ctx (see contextOf).
+  void processFunction(const llvm::Function *F, CallingContextId Ctx) {
     CurrentMemSSA = &getOrCreateMemSSA(F).MSSA;
+    CurFunc = F;
+    CurCtx = Ctx;
     for (const auto &Arg : F->args()) {
-      if (!definitelyContainsNoPointer(&Arg)) {
+      if (!definitelyContainsNoPointer(&Arg) ||
+          PunnedABI.isCoercedPointer(&Arg, F)) {
         (void)getOrInsertVar(PAGVariable(&Arg));
       }
     }
     for (const auto &I : llvm::instructions(F)) {
       processInstruction(I);
     }
+    CurFunc = nullptr;
+    CurCtx = CallingContextId::None;
   }
 
+  // If V already owns a node -- handlePhi interns incoming values eagerly, so
+  // a loop-carried GEP/cast is reached before it is translated -- the alias
+  // can't be recorded anymore; merge the two nodes instead.
   void addPtrAlias(const llvm::Value *V, const llvm::Value *Src) {
+    const AndersenVar Var{PAGVariable(V), false};
+    // The context is loop-invariant, so branch on it before iterating.
+    if (const auto Ctx = contextOf(PAGVariable(V));
+        Ctx != CallingContextId::None) {
+      forEachOpId(Src, [&](ValueId OpId) {
+        grow(OpId);
+        const ValueId Mapped =
+            CtxNodes.addAlias({.Var = Var, .Ctx = Ctx}, OpId);
+        if (Mapped != OpId) {
+          merge(Mapped, OpId);
+        }
+      });
+      return;
+    }
     forEachOpId(Src, [&](ValueId OpId) {
-      LocalVC.addAlias(AndersenVar{PAGVariable(V), false}, OpId);
       grow(OpId);
+      if (!LocalVC.addAlias(Var, OpId)) {
+        merge(*LocalVC.getOrNull(Var), OpId);
+      }
     });
   }
 
@@ -627,12 +881,18 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
       addPointee(VarId, ObjId);
       return;
     }
-    if (const auto *S = llvm::dyn_cast<llvm::StoreInst>(&I)) {
-      handleStore(S);
-      return;
-    }
-    if (const auto *L = llvm::dyn_cast<llvm::LoadInst>(&I)) {
-      handleLoad(L);
+    if (const auto Access =
+            asMemoryAccess(I, IRDB.getModule()->getDataLayout())) {
+      if (!Access->mayTransferPointer()) {
+        return;
+      }
+      if (const auto *L = llvm::dyn_cast<llvm::LoadInst>(&I)) {
+        handleLoad(L, *Access);
+      } else if (llvm::isa<llvm::StoreInst>(&I)) {
+        handleStore(*Access);
+      } else {
+        handleAtomicAccess(*Access);
+      }
       return;
     }
     if (const auto *M = llvm::dyn_cast<llvm::MemTransferInst>(&I)) {
@@ -655,6 +915,14 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
       handleSelect(S);
       return;
     }
+    if (const auto *EV = llvm::dyn_cast<llvm::ExtractValueInst>(&I)) {
+      handleExtractValue(EV);
+      return;
+    }
+    if (const auto *IV = llvm::dyn_cast<llvm::InsertValueInst>(&I)) {
+      handleInsertValue(IV);
+      return;
+    }
 
     // Casts: alias result to stripped operand (field-insensitive).
     if (const auto *Cast = llvm::dyn_cast<llvm::CastInst>(&I)) {
@@ -670,14 +938,22 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
     }
   }
 
-  void handleStore(const llvm::StoreInst *S) {
-    if (definitelyContainsNoPointer(S->getValueOperand())) {
-      return;
-    }
-    recordFieldWrite(S);
-    forEachOpId(S->getPointerOperand(), [&](ValueId PtrId) {
-      forEachOpId(S->getValueOperand(),
-                  [&](ValueId ValId) { addStore(PtrId, ValId); });
+  void handleStore(const LLVMMemoryAccess &Access) {
+    recordFieldWrite(llvm::cast<llvm::StoreInst>(Access.Instr));
+    forEachOpId(Access.Pointer, [&](ValueId PtrId) {
+      forEachOpId(
+          Access.StoredValue, [&](ValueId ValId) { addStore(PtrId, ValId); },
+          Access.Punned);
+    });
+  }
+
+  void handleAtomicAccess(const LLVMMemoryAccess &Access) {
+    const ValueId DstId = getOrInsertVar(PAGVariable(Access.LoadedInto));
+    forEachOpId(Access.Pointer, [&](ValueId PtrId) {
+      forEachOpId(
+          Access.StoredValue, [&](ValueId ValId) { addStore(PtrId, ValId); },
+          Access.Punned);
+      addLoad(PtrId, DstId);
     });
   }
 
@@ -704,14 +980,11 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
     }
     forEachOpId(S->getPointerOperand(), [&](ValueId PtrId) {
       resolveFieldWrite(PtrId);
-      UnresolvedPoisenFieldWrites.push_back(PtrId);
+      UnresolvedPoisonFieldWrites.push_back(PtrId);
     });
   }
 
-  void handleLoad(const llvm::LoadInst *L) {
-    if (definitelyContainsNoPointer(L)) {
-      return;
-    }
+  void handleLoad(const llvm::LoadInst *L, const LLVMMemoryAccess &Access) {
     if (CurrentMemSSA) {
       llvm::SmallPtrSet<const llvm::StoreInst *, 4> Defs;
       const bool HasLiveOnEntry = collectReachingDefs(L, *CurrentMemSSA, Defs);
@@ -723,27 +996,27 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
             addPtrAlias(L, ValueOp);
             return;
           }
-          // Non-pointer or ConstantExpr store value: fall through to addLoad.
-        } else {
-          const ValueId DstId = getOrInsertVar(PAGVariable(L));
-          bool AnyEdge = false;
-          for (const auto *Def : Defs) {
-            forEachOpId(Def->getValueOperand(), [&](ValueId SrcId) {
-              addAssignEdge(SrcId, DstId);
-              AnyEdge = true;
-            });
-          }
-          if (AnyEdge) {
-            return;
-          }
-          // All reaching stores have non-pointer value operands:
-          // fall through to addLoad.
+          // A ConstantExpr cannot be aliased with, but its leaves can still be
+          // assigned from below.
+        }
+
+        const ValueId DstId = getOrInsertVar(PAGVariable(L));
+        bool AnyEdge = false;
+        for (const auto *Def : Defs) {
+          forEachOpId(Def->getValueOperand(), [&](ValueId SrcId) {
+            addAssignEdge(SrcId, DstId);
+            AnyEdge = true;
+          });
         }
+        if (AnyEdge) {
+          return;
+        }
+        // All reaching stores have non-pointer value operands:
+        // fall through to addLoad.
       }
     }
     const ValueId DstId = getOrInsertVar(PAGVariable(L));
-    forEachOpId(L->getPointerOperand(),
-                [&](ValueId PtrId) { addLoad(PtrId, DstId); });
+    forEachOpId(Access.Pointer, [&](ValueId PtrId) { addLoad(PtrId, DstId); });
   }
 
   void handleMemTransfer(const llvm::MemTransferInst *M) {
@@ -797,15 +1070,41 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
     }
   }
 
+  // Aggregates are field-insensitive: one node stands for the whole value.
+  void handleExtractValue(const llvm::ExtractValueInst *EV) {
+    if (definitelyContainsNoPointer(EV)) {
+      return;
+    }
+    const ValueId Id = getOrInsertVar(PAGVariable(EV));
+    forEachOpId(EV->getAggregateOperand(),
+                [&](ValueId AggId) { addAssignEdge(AggId, Id); });
+  }
+
+  void handleInsertValue(const llvm::InsertValueInst *IV) {
+    if (definitelyContainsNoPointer(IV)) {
+      return;
+    }
+    const ValueId Id = getOrInsertVar(PAGVariable(IV));
+    forEachOpId(IV->getAggregateOperand(),
+                [&](ValueId AggId) { addAssignEdge(AggId, Id); });
+    forEachOpId(IV->getInsertedValueOperand(),
+                [&](ValueId ValId) { addAssignEdge(ValId, Id); });
+  }
+
   void handleReturn(const llvm::ReturnInst *R) {
     const auto *RetVal = R->getReturnValue();
-    if (!RetVal || definitelyContainsNoPointer(RetVal)) {
+    if (!RetVal) {
+      return;
+    }
+    const bool Punned = PunnedABI.isCoercedPointer(RetVal, R->getFunction());
+    if (!Punned && definitelyContainsNoPointer(RetVal)) {
       return;
     }
     const ValueId RetSlotId =
         getOrInsertVar(PAGVariable::Return{R->getFunction()});
-    forEachOpId(RetVal,
-                [&](ValueId ValId) { addAssignEdge(ValId, RetSlotId); });
+    forEachOpId(
+        RetVal, [&](ValueId ValId) { addAssignEdge(ValId, RetSlotId); },
+        Punned);
   }
 
   // ---- Allocation-wrapper classification -------------------------------
@@ -826,12 +1125,7 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
   // on the freshly allocated pointer (or a call to another classified
   // wrapper); if it returns true, giving each call SITE its own fresh
   // object would silently disconnect that escaping use from the object it
-  // actually observes/mutates.  This is exactly what went wrong for
-  // create_context() in the spec-mesa benchmark: it passes the freshly
-  // allocated pointer to init_api_function(), which stores function
-  // pointers into its fields -- writes that a synthetic per-call-site
-  // object would never see, so every field read after the call site
-  // spuriously came back empty.
+  // actually observes/mutates.
   bool hasEscapingUse(const llvm::Value *V,
                       llvm::SmallPtrSetImpl<const llvm::Value *> &Visited) {
     if (!Visited.insert(V).second) {
@@ -992,8 +1286,10 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
   // For each argument, add every function in pts(ArgId) to the worklist
   // as an entry point.  Used when a callee is a declaration and we want to
   // treat fn-ptr arguments as reachable callbacks (Soundy / Sound mode).
-  void
+  // Returns whether a new entry point was queued.
+  bool
   addFnPtrArgsAsEntries(llvm::ArrayRef<llvm::SmallVector<ValueId, 2>> Args) {
+    bool NewEntry = false;
     for (const auto &ArgIds : Args) {
       for (ValueId ArgId : ArgIds) {
         ArgId = rep(ArgId);
@@ -1004,18 +1300,39 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
           if (!Nodes.inbounds(ObjId)) {
             return false;
           }
-          for (const auto &Var : LocalVC.id2vars(ObjId)) {
+          forEachVar(ObjId, [&](ContextualVar CVar) {
             const auto *Fun = llvm::dyn_cast_or_null<llvm::Function>(
-                Var.getBase().valueOrNull());
-            if (Fun && !Fun->isDeclaration() && Queued.insert(Fun).second) {
-              FunctionWorklist.push_back(Fun);
+                CVar.Var.getBase().valueOrNull());
+            // Callbacks have no known caller, so they run in the root context.
+            if (Fun && !Fun->isDeclaration() &&
+                Queued.insert({Fun, CallingContextId::None}).second) {
+              FunctionWorklist.emplace_back(Fun, CallingContextId::None);
               std::ignore = CGBuilder.addFunctionVertex(Fun);
+              NewEntry = true;
             }
-          }
+          });
           return true;
         });
       }
     }
+    return NewEntry;
+  }
+
+  // Re-runs callback discovery for every recorded declaration call site.
+  //
+  // addFnPtrArgsAsEntries() reads pts(arg) at the moment the call site is
+  // first connected, and connectCallee()'s ConnectedCallees guard makes that
+  // happen exactly once.  Points-to sets keep growing afterwards, so a
+  // function pointer reaching such an argument later would never be
+  // discovered and its whole callee subgraph would go unanalyzed.  Like the
+  // other unresolved-call tables, the records are therefore re-checked once
+  // per outer round until no new entry point appears.
+  bool checkUnresolvedCallbacks() {
+    bool NewEntry = false;
+    for (const auto &Args : UnresolvedCallbacks) {
+      NewEntry |= addFnPtrArgsAsEntries(Args);
+    }
+    return NewEntry;
   }
 
   void applyLibrarySummary(
@@ -1053,11 +1370,259 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
     }
   }
 
+  // ---- Selection ------------------------------------------------------
+
+  static bool matchesAny(llvm::ArrayRef<llvm::GlobPattern> Patterns,
+                         llvm::StringRef Name) {
+    return llvm::any_of(Patterns,
+                        [&](const auto &Glob) { return Glob.match(Name); });
+  }
+
+  // Sticky once tripped, so selection can't oscillate mid-solve.
+  bool budgetExhausted() {
+    BudgetExhausted =
+        BudgetExhausted || NumContextualNodes >= CSOpts.MaxContextualNodes;
+    return BudgetExhausted;
+  }
+
+  // Whether Fun's PAG nodes are cloned per calling context.  Decided on first
+  // query and cached: selection must never change once nodes have been wired,
+  // since this solver has no way to retract an edge or shrink a pts-set.
+  [[nodiscard]] bool isSelected(const llvm::Function *Fun) {
+    if (CSOpts.isOff() || Fun->isDeclaration()) {
+      return false;
+    }
+    auto [It, Inserted] = SelectedCache.try_emplace(Fun, false);
+    if (Inserted) {
+      It->second = computeIsSelected(Fun);
+    }
+    return It->second;
+  }
+
+  bool computeIsSelected(const llvm::Function *Fun) {
+    const llvm::StringRef Name = Fun->getName();
+    if (matchesAny(DenyPatterns, Name)) {
+      return false;
+    }
+    if (matchesAny(AllowPatterns, Name)) {
+      // An explicit user request outranks the budget, in calleeContext too --
+      // a function that is selected but capped at one context is selected in
+      // name only.
+      AllowListed.insert(Fun);
+      return true;
+    }
+    switch (CSOpts.SelectionMode) {
+    case ContextSensitivityOptions::Mode::All:
+      return !budgetExhausted();
+    case ContextSensitivityOptions::Mode::Dynamic: {
+      // Cheapest tests first; only paramsEscapeOrDispatch scans the body.
+      if (budgetExhausted() || !hasMultipleCallSites(Fun)) {
+        return false;
+      }
+      const size_t Size = Fun->getInstructionCount();
+      if (Size > CSOpts.MaxContextualFunctionSize) {
+        return false;
+      }
+      if (paramsEscapeOrDispatch(Fun)) {
+        return true;
+      }
+      // Nothing a caller passed in ever leaves again, so merging the callers
+      // can only make the formals spuriously alias *within* the body. That
+      // is real but far weaker and far more common, so only pay for it where a
+      // clone is nearly free.
+      return Size <= CSOpts.MaxLocalMergeFunctionSize &&
+             hasMultiplePointerParams(Fun);
+    }
+    default:
+      return false;
+    }
+  }
+
+  // Once every caller is merged into one set of formals, several pointer
+  // parameters become mutually may-alias inside the body even though no
+  // single caller ever passed aliasing arguments -- the spec-mesa end(p, q)
+  // case, which nothing escapes, so paramsEscapeOrDispatch misses it.
+  [[nodiscard]] static bool
+  hasMultiplePointerParams(const llvm::Function *Fun) {
+    unsigned NumPtrParams = 0;
+    for (const auto &Param : Fun->args()) {
+      if (!definitelyContainsNoPointer(&Param) && ++NumPtrParams == 2) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  // Cheap over-approximation: several direct call sites, or address-taken.
+  [[nodiscard]] bool hasMultipleCallSites(const llvm::Function *Fun) {
+    auto [It, Inserted] = CallSiteCounts.try_emplace(Fun, 0);
+    if (Inserted) {
+      for (const auto *User : Fun->users()) {
+        const auto *CS = llvm::dyn_cast<llvm::CallBase>(User);
+        if (!CS || CS->getCalledOperand() != Fun) {
+          It->second = 2; // address-taken: reachable from unknown call sites
+          break;
+        }
+        if (++It->second >= 2) {
+          break;
+        }
+      }
+    }
+    return It->second >= 2;
+  }
+
+  // Scratch state for one function's worth of isParamDerived queries.
+  // OnPath breaks cycles within a single query; NotDerived memoizes completed
+  // negative answers across queries, which is what keeps the whole scan
+  // linear in the function size.
+  struct ParamDerivedCache {
+    llvm::SmallPtrSet<const llvm::Value *, 16> OnPath;
+    llvm::SmallPtrSet<const llvm::Value *, 32> NotDerived;
+  };
+
+  // Whether Val is derived from one of Fun's parameters.  Walks def-use
+  // chains backwards; on reaching a local alloca it continues through the
+  // values stored into it, which covers parameters spilled to the stack.
+  //
+  // May under-approximate through loop-carried cycles (a negative answer
+  // reached via a cut back-edge is still memoized).  This only gates
+  // selection, so a missed one costs precision, never soundness.
+  bool isParamDerived(const llvm::Value *Val, const llvm::Function *Fun,
+                      ParamDerivedCache &Cache) {
+    Val = Val->stripPointerCastsAndAliases();
+    if (Cache.NotDerived.contains(Val) || !Cache.OnPath.insert(Val).second) {
+      return false;
+    }
+    const bool Derived = computeIsParamDerived(Val, Fun, Cache);
+    Cache.OnPath.erase(Val);
+    if (!Derived) {
+      Cache.NotDerived.insert(Val);
+    }
+    return Derived;
+  }
+
+  bool computeIsParamDerived(const llvm::Value *Val, const llvm::Function *Fun,
+                             ParamDerivedCache &Cache) {
+    if (const auto *Arg = llvm::dyn_cast<llvm::Argument>(Val)) {
+      return Arg->getParent() == Fun;
+    }
+    if (const auto *Alloca = llvm::dyn_cast<llvm::AllocaInst>(Val)) {
+      return llvm::any_of(Alloca->users(), [&](const llvm::User *User) {
+        const auto *Store = llvm::dyn_cast<llvm::StoreInst>(User);
+        return Store && Store->getPointerOperand() == Alloca &&
+               isParamDerived(Store->getValueOperand(), Fun, Cache);
+      });
+    }
+    if (const auto *Load = llvm::dyn_cast<llvm::LoadInst>(Val)) {
+      return isParamDerived(Load->getPointerOperand(), Fun, Cache);
+    }
+    if (const auto *GEP = llvm::dyn_cast<llvm::GetElementPtrInst>(Val)) {
+      return isParamDerived(GEP->getPointerOperand(), Fun, Cache);
+    }
+    if (llvm::isa<llvm::PHINode, llvm::SelectInst>(Val)) {
+      const auto *Inst = llvm::cast<llvm::Instruction>(Val);
+      return llvm::any_of(Inst->operand_values(), [&](const llvm::Value *Op) {
+        return !Op->getType()->isVoidTy() && isParamDerived(Op, Fun, Cache);
+      });
+    }
+    return false;
+  }
+
+  // The generalizing signal: does anything a caller passed in *leave* Fun
+  // again?  If not, merging Fun's callers cannot pollute anything outside its
+  // body.  These are the syntactic counterparts of the precision-loss
+  // patterns Zipper identifies (Li, Tan, Xue, OOPSLA 2018):
+  //
+  //   1. a param-derived value is returned      -> pollutes callers
+  //   2. it is stored somewhere callers can see -> pollutes the heap
+  //   3. it is the callee of an indirect call   -> pollutes the call graph
+  //
+  // One pass with one shared cache, so the whole test is linear in |Fun|.
+  //
+  // Deciding this syntactically, before anything is wired, is what makes the
+  // choice usable: observing the same imprecision from the solver's own state
+  // would come too late, because the merged facts have already propagated out
+  // through the shared formals and cannot be taken back.
+  bool paramsEscapeOrDispatch(const llvm::Function *Fun) {
+    ParamDerivedCache Cache;
+    for (const auto &Inst : llvm::instructions(Fun)) {
+      if (const auto *Ret = llvm::dyn_cast<llvm::ReturnInst>(&Inst)) {
+        const auto *Val = Ret->getReturnValue();
+        if (Val && !definitelyContainsNoPointer(Val) &&
+            isParamDerived(Val, Fun, Cache)) {
+          return true;
+        }
+        continue;
+      }
+      if (const auto *Store = llvm::dyn_cast<llvm::StoreInst>(&Inst)) {
+        const auto *Val = Store->getValueOperand();
+        if (definitelyContainsNoPointer(Val) ||
+            !isParamDerived(Val, Fun, Cache)) {
+          continue;
+        }
+        // A store into a local alloca stays inside Fun; only stores through a
+        // global or a param-derived pointer are visible to the caller.
+        const auto *Ptr =
+            Store->getPointerOperand()->stripPointerCastsAndAliases();
+        if (llvm::isa<llvm::GlobalValue>(Ptr) ||
+            isParamDerived(Ptr, Fun, Cache)) {
+          return true;
+        }
+        continue;
+      }
+      const auto *CS = llvm::dyn_cast<llvm::CallBase>(&Inst);
+      if (!CS || CS->isInlineAsm() || CS->isDebugOrPseudoInst()) {
+        continue;
+      }
+      const auto *Callee =
+          CS->getCalledOperand()->stripPointerCastsAndAliases();
+      if (!llvm::isa<llvm::Function>(Callee) &&
+          isParamDerived(Callee, Fun, Cache)) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  // Pushes CS onto CallerCtx; with k = 1 the result depends on CS alone.
+  CallingContextId pushContext(CallingContextId CallerCtx,
+                               const llvm::CallBase *CS) {
+    return Contexts.getOrInsert(Contexts[CallerCtx].withPrefix(CS));
+  }
+
+  // The context the body of Callee runs in for this call. Once Callee has
+  // been cloned MaxContextsPerFunction times, or the global node budget is
+  // spent, further call sites fall back to the shared root context.
+  CallingContextId calleeContext(const llvm::Function *Callee,
+                                 CallingContextId CallerCtx,
+                                 const llvm::CallBase *CS) {
+    if (!isSelected(Callee)) {
+      return CallingContextId::None;
+    }
+    const CallingContextId Ctx = pushContext(CallerCtx, CS);
+    auto &Seen = ContextsPerFn[Callee];
+    if (Seen.contains(Ctx)) {
+      return Ctx;
+    }
+    if (Seen.size() >= CSOpts.MaxContextsPerFunction ||
+        (budgetExhausted() && !AllowListed.contains(Callee))) {
+      return CallingContextId::None;
+    }
+    Seen.insert(Ctx);
+    return Ctx;
+  }
+
   bool connectCallee(const llvm::CallBase *CS, const llvm::Function *Callee,
                      llvm::ArrayRef<llvm::SmallVector<ValueId, 2>> Args,
-                     std::optional<ValueId> CSRetVal) {
-    const ValueId CalleeId = getOrInsertVar(PAGVariable(Callee));
-    if (!ConnectedCallees[CS].insert(CalleeId).second) {
+                     std::optional<ValueId> CSRetVal,
+                     CallingContextId CallerCtx) {
+    // Interned only to key ConnectedCallees compactly; see its declaration.
+    const ValueId CalleeId =
+        getOrInsertVar(PAGVariable(Callee), CallingContextId::None);
+    const CallingContextId CalleeCtx = calleeContext(Callee, CallerCtx, CS);
+    const uint64_t Connection =
+        uint64_t(uint32_t(CalleeId)) << 32 | uint32_t(CalleeCtx);
+    if (!ConnectedCallees[{CS, CallerCtx}].insert(Connection).second) {
       return false;
     }
     CGBuilder.addCallEdge(CS, Callee);
@@ -1067,14 +1632,17 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
         applyLibrarySummary(*LibSum, Callee, Args, CSRetVal);
         return false;
       }
-      if (SoundnessFlag != Soundness::Unsound) {
-        addFnPtrArgsAsEntries(Args);
+      if (SoundnessFlag != Soundness::Unsound &&
+          llvm::any_of(Args,
+                       [](const auto &ArgIds) { return !ArgIds.empty(); })) {
+        std::ignore = addFnPtrArgsAsEntries(Args);
+        UnresolvedCallbacks.emplace_back(Args.begin(), Args.end());
       }
       return false;
     }
 
-    if (Queued.insert(Callee).second) {
-      FunctionWorklist.push_back(Callee);
+    if (Queued.insert({Callee, CalleeCtx}).second) {
+      FunctionWorklist.emplace_back(Callee, CalleeCtx);
     }
 
     if (CSRetVal && !Callee->getReturnType()->isVoidTy()) {
@@ -1082,19 +1650,23 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
         // Give this call SITE its own fresh object instead of merging
         // through Callee's shared internal allocation site, which would
         // spuriously alias every call to this wrapper.
-        const ValueId ObjId = getOrInsertObj(PAGVariable(CS));
+        const ValueId ObjId = getOrInsertObj(PAGVariable(CS), CallerCtx);
         addPointee(*CSRetVal, ObjId);
       } else {
-        const ValueId RetSlotId = getOrInsertVar(PAGVariable::Return{Callee});
+        const ValueId RetSlotId =
+            getOrInsertVar(PAGVariable::Return{Callee}, CalleeCtx);
         addAssignEdge(RetSlotId, *CSRetVal);
       }
     }
 
     for (const auto &[Param, ArgIds] : llvm::zip(Callee->args(), Args)) {
-      if (ArgIds.empty() || definitelyContainsNoPointer(&Param)) {
+      // A coerced actual has ids despite its pointer-free type; passing it on
+      // is what makes the formal a coerced parameter in the first place.
+      if (ArgIds.empty() || (definitelyContainsNoPointer(&Param) &&
+                             !mayHidePointer(DL, Param.getType()))) {
         continue;
       }
-      const ValueId ParamId = getOrInsertVar(PAGVariable(&Param));
+      const ValueId ParamId = getOrInsertVar(PAGVariable(&Param), CalleeCtx);
       for (ValueId ArgId : ArgIds) {
         addAssignEdge(ArgId, ParamId);
       }
@@ -1106,7 +1678,8 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
 
   bool resolveVtableCall(const llvm::CallBase *CS, ValueId VtablePtrId,
                          uint64_t VtableIndex, const ArgList &Args,
-                         std::optional<ValueId> CSRetVal) {
+                         std::optional<ValueId> CSRetVal,
+                         CallingContextId CallerCtx) {
     VtablePtrId = rep(VtablePtrId);
     if (!Nodes.inbounds(VtablePtrId)) {
       llvm::report_fatal_error("Invalid Vtable Id #" +
@@ -1119,29 +1692,29 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
       if (!Nodes.inbounds(ObjId)) {
         return false;
       }
-      for (const auto &Var : LocalVC.id2vars(ObjId)) {
+      forEachVar(ObjId, [&](ContextualVar CVar) {
         const auto *GV = llvm::dyn_cast_or_null<llvm::GlobalVariable>(
-            Var.getBase().valueOrNull());
+            CVar.Var.getBase().valueOrNull());
         if (!GV || !GV->hasName() ||
             !GV->getName().starts_with(DIBasedTypeHierarchy::VTablePrefix) ||
             !GV->hasInitializer()) {
-          continue;
+          return;
         }
         const auto *VTStruct =
             llvm::dyn_cast<llvm::ConstantStruct>(GV->getInitializer());
         if (!VTStruct) {
-          continue;
+          return;
         }
         auto VFs = LLVMVFTable::getVFVectorFromIRVTable(*VTStruct);
         if (VtableIndex >= VFs.size()) {
-          continue;
+          return;
         }
         const auto *Callee = VFs[VtableIndex];
         if (!Callee || !isConsistentCall(CS, Callee)) {
-          continue;
+          return;
         }
-        NewEdge |= connectCallee(CS, Callee, Args, CSRetVal);
-      }
+        NewEdge |= connectCallee(CS, Callee, Args, CSRetVal, CallerCtx);
+      });
       return true;
     });
     return NewEdge;
@@ -1160,9 +1733,9 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
       if (!Nodes.inbounds(ObjId)) {
         return false;
       }
-      for (const auto &Var : LocalVC.id2vars(ObjId)) {
+      forEachVar(ObjId, [&](ContextualVar CVar) {
         // Resolve GlobalAlias to the underlying GlobalVariable.
-        const llvm::Value *Val = Var.getBase().valueOrNull();
+        const llvm::Value *Val = CVar.Var.getBase().valueOrNull();
         if (const auto *GA = llvm::dyn_cast_or_null<llvm::GlobalAlias>(Val)) {
           Val = GA->getAliaseeObject();
         }
@@ -1170,22 +1743,23 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
         if (!GV || !GV->isConstant() || !GV->hasInitializer()) {
           // Not a usable const global: try the dynamically observed
           // field-write table for heap/stack dispatch-table objects.
-          if (Val && !ImpureObjects.contains(Val)) {
+          const ObjectKey Obj{.Val = Val, .Ctx = CVar.Ctx};
+          if (Val && !ImpureObjects.contains(Obj)) {
             auto It = FnPtrFieldWrites.find(
-                FieldWriteKey{.Val = Val, .Indices = Rec.Indices});
+                FieldWriteKey{.Obj = Obj, .Indices = Rec.Indices});
             if (It != FnPtrFieldWrites.end() &&
                 It->second.ElemTy == Rec.GEPElemTy) {
               for (const auto *Callee : It->second.Callees) {
                 if (isConsistentCall(Rec.CS, Callee)) {
-                  NewEdge |=
-                      connectCallee(Rec.CS, Callee, Rec.Args, Rec.CSRetVal);
+                  NewEdge |= connectCallee(Rec.CS, Callee, Rec.Args,
+                                           Rec.CSRetVal, Rec.Ctx);
                 }
               }
-              continue;
+              return;
             }
           }
           NeedFPFallback = true;
-          continue;
+          return;
         }
         // Type check: GV must be of GEPElemTy or [N x GEPElemTy].
         // Field-insensitive aliasing can put wrong-type objects in pts.
@@ -1194,45 +1768,47 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
           const auto *ArrTy = llvm::dyn_cast<llvm::ArrayType>(GVTy);
           if (!ArrTy || ArrTy->getElementType() != Rec.GEPElemTy) {
             NeedFPFallback = true;
-            continue;
+            return;
           }
         }
         const auto *Callee =
             walkConstInitPath(GV->getInitializer(), Rec.Indices);
         if (!Callee || !isConsistentCall(Rec.CS, Callee)) {
-          continue;
+          return;
         }
-        NewEdge |= connectCallee(Rec.CS, Callee, Rec.Args, Rec.CSRetVal);
-      }
+        NewEdge |=
+            connectCallee(Rec.CS, Callee, Rec.Args, Rec.CSRetVal, Rec.Ctx);
+      });
       return true;
     });
     if (NeedFPFallback) {
-      NewEdge |= resolveFPCall(Rec.CS, Rec.FPId, Rec.Args, Rec.CSRetVal);
+      NewEdge |=
+          resolveFPCall(Rec.CS, Rec.FPId, Rec.Args, Rec.CSRetVal, Rec.Ctx);
     }
     return NewEdge;
   }
 
-  [[nodiscard]] bool poisonObject(const llvm::Value *AllocVal) {
-    return ImpureObjects.insert(AllocVal).second;
+  [[nodiscard]] bool poisonObject(ObjectKey AllocObj) {
+    return ImpureObjects.insert(AllocObj).second;
   }
 
   // Merges one field's known writes (Src, e.g. a single-callee write, or an
   // entry copied from another object) into AllocVal's own entry for
   // Indices. A differently-typed pre-existing entry for the same slot means
   // type punning: poison the whole object instead of trusting either write.
-  bool mergeFieldWriteInfo(const llvm::Value *AllocVal,
+  bool mergeFieldWriteInfo(ObjectKey AllocObj,
                            const llvm::SmallVector<uint64_t, 3> &Indices,
                            const FieldWriteInfo &Src) {
-    if (ImpureObjects.contains(AllocVal)) {
+    if (ImpureObjects.contains(AllocObj)) {
       return false;
     }
     auto [It, Inserted] = FnPtrFieldWrites.try_emplace(
-        FieldWriteKey{.Val = AllocVal, .Indices = Indices});
+        FieldWriteKey{.Obj = AllocObj, .Indices = Indices});
     if (Inserted) {
       It->second.ElemTy = Src.ElemTy;
-      FieldsByObject[AllocVal].push_back(Indices);
+      FieldsByObject[AllocObj].push_back(Indices);
     } else if (It->second.ElemTy != Src.ElemTy) {
-      return poisonObject(AllocVal);
+      return poisonObject(AllocObj);
     }
     bool Changed = Inserted;
     for (const auto *Callee : Src.Callees) {
@@ -1263,12 +1839,13 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
       if (!Nodes.inbounds(DstObjId)) {
         return false;
       }
-      for (const auto &DstVar : LocalVC.id2vars(DstObjId)) {
-        const llvm::Value *DstVal = DstVar.getBase().valueOrNull();
-        if (!DstVal || ImpureObjects.contains(DstVal)) {
-          continue;
+      forEachVar(DstObjId, [&](ContextualVar DstVar) {
+        const llvm::Value *DstVal = DstVar.Var.getBase().valueOrNull();
+        const ObjectKey DstObj{.Val = DstVal, .Ctx = DstVar.Ctx};
+        if (!DstVal || ImpureObjects.contains(DstObj)) {
+          return;
         }
-        const auto DstFieldsIt = FieldsByObject.find(DstVal);
+        const auto DstFieldsIt = FieldsByObject.find(DstObj);
         const bool DstHasEntries =
             DstFieldsIt != FieldsByObject.end() && !DstFieldsIt->second.empty();
         bool Poison = !Rec.CopyLength;
@@ -1283,16 +1860,17 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
             if (!Nodes.inbounds(SrcObjId)) {
               return false;
             }
-            for (const auto &SrcVar : LocalVC.id2vars(SrcObjId)) {
-              const llvm::Value *SrcVal = SrcVar.getBase().valueOrNull();
+            forEachVar(SrcObjId, [&](ContextualVar SrcVar) {
+              const llvm::Value *SrcVal = SrcVar.Var.getBase().valueOrNull();
               if (!SrcVal) {
-                continue;
+                return;
               }
-              if (ImpureObjects.contains(SrcVal)) {
+              const ObjectKey SrcObj{.Val = SrcVal, .Ctx = SrcVar.Ctx};
+              if (ImpureObjects.contains(SrcObj)) {
                 Poison = true;
-                continue;
+                return;
               }
-              if (SrcVal != DstVal && DstHasEntries) {
+              if (SrcObj != DstObj && DstHasEntries) {
                 // A genuinely external source could clobber DstVal's own
                 // separately-tracked fields with bytes we know nothing
                 // about. A self-copy (field-insensitively-aliased src/dst,
@@ -1300,15 +1878,15 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
                 // merging an object's own known fields into itself is a
                 // no-op.
                 Poison = true;
-                continue;
+                return;
               }
-              const auto SrcFieldsIt = FieldsByObject.find(SrcVal);
+              const auto SrcFieldsIt = FieldsByObject.find(SrcObj);
               if (SrcFieldsIt == FieldsByObject.end()) {
-                continue;
+                return;
               }
               for (const auto &Indices : SrcFieldsIt->second) {
                 const auto FWIt = FnPtrFieldWrites.find(
-                    FieldWriteKey{.Val = SrcVal, .Indices = Indices});
+                    FieldWriteKey{.Obj = SrcObj, .Indices = Indices});
                 assert(FWIt != FnPtrFieldWrites.end());
                 if (*Rec.CopyLength <
                     DL.getTypeAllocSize(FWIt->second.ElemTy).getFixedValue()) {
@@ -1317,18 +1895,18 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
                 }
                 ToMerge.emplace_back(Indices, FWIt->second);
               }
-            }
+            });
             return true;
           });
         }
         if (Poison) {
-          Changed |= poisonObject(DstVal);
-          continue;
+          Changed |= poisonObject(DstObj);
+          return;
         }
         for (const auto &[Indices, Info] : ToMerge) {
-          Changed |= mergeFieldWriteInfo(DstVal, Indices, Info);
+          Changed |= mergeFieldWriteInfo(DstObj, Indices, Info);
         }
-      }
+      });
       return true;
     });
     return Changed;
@@ -1351,24 +1929,26 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
       if (!Nodes.inbounds(ObjId)) {
         return false;
       }
-      for (const auto &Var : LocalVC.id2vars(ObjId)) {
-        const llvm::Value *AllocVal = Var.getBase().valueOrNull();
+      forEachVar(ObjId, [&](ContextualVar CVar) {
+        const llvm::Value *AllocVal = CVar.Var.getBase().valueOrNull();
         if (!AllocVal) {
-          continue;
+          return;
         }
 
         FieldWriteInfo Info;
         Info.ElemTy = Rec.GEPElemTy;
         Info.Callees.push_back(Rec.Callee);
-        Changed |= mergeFieldWriteInfo(AllocVal, Rec.Indices, Info);
-      }
+        Changed |= mergeFieldWriteInfo({.Val = AllocVal, .Ctx = CVar.Ctx},
+                                       Rec.Indices, Info);
+      });
       return true;
     });
     return Changed;
   }
 
-  // Poisen all
+  // Poison all objects in pts(PtrId).
   bool resolveFieldWrite(ValueId PtrId) {
+    PtrId = rep(PtrId);
     if (!Nodes.inbounds(PtrId)) {
       return false;
     }
@@ -1378,14 +1958,14 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
       if (!Nodes.inbounds(ObjId)) {
         return false;
       }
-      for (const auto &Var : LocalVC.id2vars(ObjId)) {
-        const llvm::Value *AllocVal = Var.getBase().valueOrNull();
+      forEachVar(ObjId, [&](ContextualVar CVar) {
+        const llvm::Value *AllocVal = CVar.Var.getBase().valueOrNull();
         if (!AllocVal) {
-          continue;
+          return;
         }
 
-        Changed |= poisonObject(AllocVal);
-      }
+        Changed |= poisonObject({.Val = AllocVal, .Ctx = CVar.Ctx});
+      });
       return true;
     });
     return Changed;
@@ -1400,14 +1980,15 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
     for (const auto &Rec : UnresolvedQualFieldWrites) {
       Changed |= resolveFieldWrite(Rec);
     }
-    for (const auto &Rec : UnresolvedPoisenFieldWrites) {
+    for (const auto &Rec : UnresolvedPoisonFieldWrites) {
       Changed |= resolveFieldWrite(Rec);
     }
     return Changed;
   }
 
   bool resolveFPCall(const llvm::CallBase *CS, ValueId FPId,
-                     const ArgList &Args, std::optional<ValueId> CSRetVal) {
+                     const ArgList &Args, std::optional<ValueId> CSRetVal,
+                     CallingContextId CallerCtx) {
     FPId = rep(FPId);
     if (!Nodes.inbounds(FPId)) {
       llvm::report_fatal_error("Invalid FPId");
@@ -1420,13 +2001,13 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
         // Iteration is in sorted order
         return false;
       }
-      for (const auto &Var : LocalVC.id2vars(ObjId)) {
-        const auto *Fun =
-            llvm::dyn_cast_or_null<llvm::Function>(Var.getBase().valueOrNull());
+      forEachVar(ObjId, [&](ContextualVar CVar) {
+        const auto *Fun = llvm::dyn_cast_or_null<llvm::Function>(
+            CVar.Var.getBase().valueOrNull());
         if (Fun && isConsistentCall(CS, Fun)) {
-          NewEdge |= connectCallee(CS, Fun, Args, CSRetVal);
+          NewEdge |= connectCallee(CS, Fun, Args, CSRetVal, CallerCtx);
         }
-      }
+      });
       return true;
     });
     return NewEdge;
@@ -1441,18 +2022,22 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
     ArgList Args;
     for (const auto &Arg : C->args()) {
       auto &ArgIds = Args.emplace_back();
-      if (!definitelyContainsNoPointer(Arg.get())) {
-        forEachOpId(Arg.get(), [&](ValueId Id) { ArgIds.push_back(Id); });
+      const bool Punned = PunnedABI.isCoercedPointer(Arg.get(), CurFunc);
+      if (Punned || !definitelyContainsNoPointer(Arg.get())) {
+        forEachOpId(
+            Arg.get(), [&](ValueId Id) { ArgIds.push_back(Id); }, Punned);
       }
     }
 
     std::optional<ValueId> CSRetVal;
-    if (C->getType()->isPointerTy()) {
+    // Mirrors handleReturn's gate: an aggregate return also fills a slot.
+    if (!definitelyContainsNoPointer(C->getType()) ||
+        PunnedABI.isCoercedPointer(C, CurFunc)) {
       const ValueId VarId = getOrInsertVar(PAGVariable(C));
       CSRetVal = VarId;
       const auto *DirectCallee = llvm::dyn_cast<llvm::Function>(
           C->getCalledOperand()->stripPointerCastsAndAliases());
-      if (DirectCallee &&
+      if (DirectCallee && C->getType()->isPointerTy() &&
           psr::isHeapAllocatingFunction(DirectCallee->getName())) {
         const ValueId ObjId = getOrInsertObj(PAGVariable(C));
         addPointee(VarId, ObjId);
@@ -1462,7 +2047,7 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
     const auto *FnPtr = C->getCalledOperand()->stripPointerCastsAndAliases();
 
     if (const auto *Callee = llvm::dyn_cast<llvm::Function>(FnPtr)) {
-      connectCallee(C, Callee, Args, CSRetVal);
+      connectCallee(C, Callee, Args, CSRetVal, CurCtx);
       return;
     }
 
@@ -1470,13 +2055,14 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
     if (auto VCallInfo = getVFTIndexAndVT(C)) {
       auto [VtablePtr, VtableIndex] = *VCallInfo;
       const ValueId VtablePtrId = getOrInsertVar(PAGVariable(VtablePtr));
-      resolveVtableCall(C, VtablePtrId, VtableIndex, Args, CSRetVal);
+      resolveVtableCall(C, VtablePtrId, VtableIndex, Args, CSRetVal, CurCtx);
       UnresolvedVCalls.push_back(VCallRecord{
           .CS = C,
           .VtablePtrId = VtablePtrId,
           .VtableIndex = VtableIndex,
           .Args = std::move(Args),
           .CSRetVal = CSRetVal,
+          .Ctx = CurCtx,
       });
       return;
     }
@@ -1497,6 +2083,7 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
           .GEPElemTy = GEPElemTy,
           .Args = std::move(Args),
           .CSRetVal = CSRetVal,
+          .Ctx = CurCtx,
       };
       resolveStructVCall(Rec);
       UnresolvedStructVCalls.push_back(std::move(Rec));
@@ -1505,19 +2092,21 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
 
     // Indirect call: connect already-known targets, record for fixpoint.
     const ValueId FPId = getOrInsertVar(PAGVariable(FnPtr));
-    resolveFPCall(C, FPId, Args, CSRetVal);
+    resolveFPCall(C, FPId, Args, CSRetVal, CurCtx);
     UnresolvedFPCalls.push_back(FPCallRecord{
         .CS = C,
         .FPId = FPId,
         .Args = std::move(Args),
         .CSRetVal = CSRetVal,
+        .Ctx = CurCtx,
     });
   }
 
   bool checkUnresolvedFPCalls() {
     bool NewEdge = false;
     for (const auto &Rec : UnresolvedFPCalls) {
-      NewEdge |= resolveFPCall(Rec.CS, Rec.FPId, Rec.Args, Rec.CSRetVal);
+      NewEdge |=
+          resolveFPCall(Rec.CS, Rec.FPId, Rec.Args, Rec.CSRetVal, Rec.Ctx);
     }
     return NewEdge;
   }
@@ -1526,7 +2115,7 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
     bool NewEdge = false;
     for (const auto &Rec : UnresolvedVCalls) {
       NewEdge |= resolveVtableCall(Rec.CS, Rec.VtablePtrId, Rec.VtableIndex,
-                                   Rec.Args, Rec.CSRetVal);
+                                   Rec.Args, Rec.CSRetVal, Rec.Ctx);
     }
     return NewEdge;
   }
@@ -1546,33 +2135,42 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
 
     // Map variable local IDs → external VC IDs.
     // Object nodes are internal only and do not appear in the external result.
-    TypedVector<ValueId, std::optional<ValueId>> LocalToExt(NumLocal);
+    // Context clones of one PAGVariable share an external id, so the reported
+    // alias set of a formal is the union over its contexts, while call sites
+    // and locals -- distinct PAGVariables -- keep their per-context precision.
+    // A node normally gets one external id; it gets more when a caller-supplied
+    // ExternalVC already mapped two of its names to distinct ids, which
+    // addAlias cannot undo. Keeping both makes them share the alias set.
+    TypedVector<ValueId, llvm::SmallVector<ValueId, 1>> LocalToExt(NumLocal);
     for (auto VId : iota<ValueId>(NumLocal)) {
       std::optional<ValueId> FirstExtId;
-      for (const auto &V : LocalVC.id2vars(VId)) {
-        if (V.isObject()) {
-          continue;
+      forEachVar(VId, [&](ContextualVar CVar) {
+        if (CVar.Var.isObject()) {
+          return;
         }
         if (!FirstExtId) {
-          FirstExtId = ExternalVC.insert(V.getBase()).first;
-          LocalToExt[VId] = FirstExtId;
-        } else {
-          ExternalVC.addAlias(V.getBase(), *FirstExtId);
+          FirstExtId = ExternalVC.insert(CVar.Var.getBase()).first;
+          LocalToExt[VId].push_back(*FirstExtId);
+        } else if (!ExternalVC.addAlias(CVar.Var.getBase(), *FirstExtId)) {
+          const ValueId Existing = *ExternalVC.getOrNull(CVar.Var.getBase());
+          if (!llvm::is_contained(LocalToExt[VId], Existing)) {
+            LocalToExt[VId].push_back(Existing);
+          }
         }
-      }
+      });
     }
 
     // Build rep → bitset of external IDs for all vars in that SCC.
     TypedVector<ValueId, llvm::SmallVector<ValueId>> RepToExtVIds(NumLocal);
     for (auto VId : iota<ValueId>(NumLocal)) {
-      if (!LocalToExt[VId]) {
+      if (LocalToExt[VId].empty()) {
         continue;
       }
       const ValueId RepId = rep(VId);
       if (!Nodes.inbounds(RepId)) {
         continue;
       }
-      RepToExtVIds[RepId].push_back(*LocalToExt[VId]);
+      llvm::append_range(RepToExtVIds[RepId], LocalToExt[VId]);
     }
 
     // Reverse map: abstract object → bitset of representatives pointing to it.
@@ -1610,7 +2208,8 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
             Buf.push_back(uint32_t(EId));
           }
         });
-        std::ranges::sort(Buf);
+        // Context clones share an external id, so Buf routinely has duplicates.
+        sortUnique(Buf);
         ObjToAliasExtVIds[Obj].insertSorted(Buf);
         Buf.clear();
       }
@@ -1656,11 +2255,12 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
     bool Changed{};
     do {
       while (!FunctionWorklist.empty()) {
-        const auto *F = FunctionWorklist.pop_back_val();
-        if (!Processed.insert(F).second) {
-          continue;
-        }
-        processFunction(F);
+        const auto [F, Ctx] = FunctionWorklist.pop_back_val();
+        // Queued is insert-only, so its guard on every push site is what
+        // keeps a FuncCtx from popping twice.
+        assert(Queued.contains({F, Ctx}) &&
+               "Unguarded push to FunctionWorklist");
+        processFunction(F, Ctx);
         // Drain pending pts for functions that make no pointer-relevant
         // calls (connectCallee would otherwise be the only propagate site).
         propagate();
@@ -1669,6 +2269,7 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
       Changed |= checkUnresolvedFPCalls();
       Changed |= checkUnresolvedVCalls();
       Changed |= checkUnresolvedStructVCalls();
+      Changed |= checkUnresolvedCallbacks();
     } while (!FunctionWorklist.empty() || Changed);
 
     return buildResult();
@@ -1679,11 +2280,12 @@ struct [[clang::internal_linkage]] AndersenOTFSolver::SolverData {
 
 AndersenOTFSolver::AndersenOTFSolver(
     const LLVMProjectIRDB &IRDB, llvm::ArrayRef<const llvm::Function *> Entries,
-    ValueCompressor<PAGVariable> &VC, Soundness S) noexcept
-    : IRDB(IRDB), Entries(Entries), VC(VC), S(S) {}
+    ValueCompressor<PAGVariable> &VC, Soundness S,
+    ContextSensitivityOptions CSOpts) noexcept
+    : IRDB(IRDB), Entries(Entries), VC(VC), S(S), CSOpts(std::move(CSOpts)) {}
 
 AndersenOTFResult AndersenOTFSolver::solve() {
-  SolverData Impl{*IRDB, Entries, *VC, S};
+  SolverData Impl{*IRDB, Entries, *VC, S, CSOpts};
   return Impl.run();
 }
 
@@ -1693,23 +2295,23 @@ AndersenOTFResult
 psr::computeAndersenOTFRaw(const LLVMProjectIRDB &IRDB,
                            llvm::ArrayRef<const llvm::Function *> EntryPoints,
                            MaybeUniquePtr<ValueCompressor<PAGVariable>> VC,
-                           Soundness S) {
+                           Soundness S, ContextSensitivityOptions CSOpts) {
   if (!VC) {
     VC = std::make_unique<ValueCompressor<PAGVariable>>();
   }
-  AndersenOTFSolver Solver(IRDB, EntryPoints, *VC, S);
+  AndersenOTFSolver Solver(IRDB, EntryPoints, *VC, S, std::move(CSOpts));
   return Solver.solve();
 }
 
-LLVMUnionFindAliasIterator<AndersenOTFResult>
+LLVMRawAliasIterator<AndersenOTFResult>
 psr::computeAndersenOTF(const LLVMProjectIRDB &IRDB,
                         llvm::ArrayRef<const llvm::Function *> EntryPoints,
                         MaybeUniquePtr<ValueCompressor<PAGVariable>> VC,
-                        Soundness S) {
+                        Soundness S, ContextSensitivityOptions CSOpts) {
   if (!VC) {
     VC = std::make_unique<ValueCompressor<PAGVariable>>();
   }
-  AndersenOTFSolver Solver(IRDB, EntryPoints, *VC, S);
+  AndersenOTFSolver Solver(IRDB, EntryPoints, *VC, S, std::move(CSOpts));
   auto Res = Solver.solve();
-  return LLVMUnionFindAliasIterator{std::move(Res), std::move(VC)};
+  return LLVMRawAliasIterator{std::move(Res), std::move(VC)};
 }
diff --git a/lib/PhasarLLVM/Pointer/LLVMBasedAliasAnalysis.cpp b/lib/PhasarLLVM/Pointer/LLVMBasedAliasAnalysis.cpp
index 0b9dab8418..2c2467c566 100644
--- a/lib/PhasarLLVM/Pointer/LLVMBasedAliasAnalysis.cpp
+++ b/lib/PhasarLLVM/Pointer/LLVMBasedAliasAnalysis.cpp
@@ -32,6 +32,7 @@
 #include "llvm/IR/Value.h"
 #include "llvm/IR/Verifier.h"
 #include "llvm/Passes/PassBuilder.h"
+#include "llvm/Support/ErrorHandling.h"
 
 #include "external/llvm/CFLAndersAliasAnalysis.h"
 #include "external/llvm/CFLSteensAliasAnalysis.h"
@@ -77,9 +78,11 @@ LLVMBasedAliasAnalysis::LLVMBasedAliasAnalysis(LLVMProjectIRDB &IRDB,
       AA.registerFunctionAnalysis<llvm::CFLSteensAA>();
       break;
     case AliasAnalysisType::Basic:
-      [[fallthrough]];
-    default:
       break;
+    default:
+      llvm::report_fatal_error(
+          "Alias analysis type not handled by LLVMBasedAliasAnalysis: " +
+          llvm::Twine(toString(PATy)));
     }
 
     // Note: The order of the alias analyses is important. See LLVM's source
diff --git a/lib/PhasarLLVM/Pointer/LLVMPointerAssignmentGraph.cpp b/lib/PhasarLLVM/Pointer/LLVMPointerAssignmentGraph.cpp
index d3b0ffae77..c960b6c6b4 100644
--- a/lib/PhasarLLVM/Pointer/LLVMPointerAssignmentGraph.cpp
+++ b/lib/PhasarLLVM/Pointer/LLVMPointerAssignmentGraph.cpp
@@ -2,6 +2,7 @@
 
 #include "phasar/PhasarLLVM/DB/LLVMProjectIRDB.h"
 #include "phasar/PhasarLLVM/Pointer/LLVMGlobalInitCache.h"
+#include "phasar/PhasarLLVM/Pointer/LLVMPointerSemantics.h"
 #include "phasar/PhasarLLVM/Pointer/MemSSAUtils.h"
 #include "phasar/PhasarLLVM/Utils/LLVMFunctionDataFlowFacts.h"
 #include "phasar/PhasarLLVM/Utils/LLVMShorthands.h"
@@ -79,6 +80,7 @@ struct [[clang::internal_linkage]] LLVMPAGBuilder::PAGBuildData {
   const llvm::DataLayout &DL;           // NOLINT
   ValueCompressor<v_t> &VC;             // NOLINT
   const PAGMappedLibrarySummary &MLSum; // NOLINT
+  PunnedABICache PunnedABI{&DL};
 
   LLVMPAGBuilder::MemSSAProviderFn *MemSSAProvider = nullptr;
   llvm::MemorySSA *CurrentMemSSA = nullptr;
@@ -104,6 +106,25 @@ struct [[clang::internal_linkage]] LLVMPAGBuilder::PAGBuildData {
     return Id;
   }
 
+  // Registers \p V as another name for node \p Id, i.e. makes the two the
+  // same node.
+  //
+  // If \p V already owns a node the alias can no longer be recorded. Fall back
+  // to a pair of Assign edges
+  void addAliasOrEquate(LLVMPBStrategyRef Strategy, PAGVariable V, ValueId Id,
+                        const llvm::Instruction *AtInstruction) {
+    if (VC.addAlias(V, Id)) {
+      return;
+    }
+    const auto Existing = VC.getOrNull(V);
+    assert(Existing && "addAlias only fails when V already owns an id");
+    if (*Existing == Id) {
+      return;
+    }
+    addEdge(Strategy, Id, *Existing, Assign{}, AtInstruction);
+    addEdge(Strategy, *Existing, Id, Assign{}, AtInstruction);
+  }
+
   void addAllIncomingStores(LLVMPBStrategyRef Strategy, ValueId To,
                             llvm::SmallDenseMap<ValueId, Edge, 2> &Froms) {
     for (auto [From, E] : Froms) {
@@ -255,12 +276,17 @@ struct [[clang::internal_linkage]] LLVMPAGBuilder::PAGBuildData {
       return (void)getVariable(Alloca, Strategy);
     }
 
-    if (const auto *Store = llvm::dyn_cast<llvm::StoreInst>(&I)) {
-      return handleStore(Strategy, Store);
-    }
-
-    if (const auto *Load = llvm::dyn_cast<llvm::LoadInst>(&I)) {
-      return handleLoad(Strategy, Load);
+    if (const auto Access = asMemoryAccess(I, DL)) {
+      if (!Access->mayTransferPointer()) {
+        return;
+      }
+      if (const auto *Load = llvm::dyn_cast<llvm::LoadInst>(&I)) {
+        return handleLoad(Strategy, Load, *Access);
+      }
+      if (llvm::isa<llvm::StoreInst>(&I)) {
+        return handleStore(Strategy, *Access);
+      }
+      return handleAtomicAccess(Strategy, *Access);
     }
 
     if (const auto *Cast = llvm::dyn_cast<llvm::CastInst>(&I)) {
@@ -306,26 +332,31 @@ struct [[clang::internal_linkage]] LLVMPAGBuilder::PAGBuildData {
     psr::forEachPointerOperand(RawOp, copyOrRef(Handler));
   }
 
-  void handleStore(LLVMPBStrategyRef Strategy, const llvm::StoreInst *Store) {
-
-    if (definitelyContainsNoPointer(Store->getValueOperand())) {
-      return;
-    }
-
-    handleOperand(Store->getPointerOperand(), [&](const auto *PointerOp) {
+  void handleStore(LLVMPBStrategyRef Strategy, const LLVMMemoryAccess &Access) {
+    handleOperand(Access.Pointer, [&](const auto *PointerOp) {
       auto PointerObj = getVariable(PointerOp, Strategy);
-      handleOperand(Store->getValueOperand(), [&](const auto *ValueOp) {
+      handleOperand(Access.StoredValue, [&](const auto *ValueOp) {
         auto ValueObj = getVariable(ValueOp, Strategy);
-        addEdge(Strategy, ValueObj, PointerObj, StorePOI{}, Store);
+        addEdge(Strategy, ValueObj, PointerObj, StorePOI{}, Access.Instr);
       });
     });
   }
 
-  void handleLoad(LLVMPBStrategyRef Strategy, const llvm::LoadInst *Ld) {
-    if (definitelyContainsNoPointer(Ld)) {
-      return;
-    }
+  void handleAtomicAccess(LLVMPBStrategyRef Strategy,
+                          const LLVMMemoryAccess &Access) {
+    auto DstObj = getVariable(Access.LoadedInto, Strategy);
+    handleOperand(Access.Pointer, [&](const auto *PointerOp) {
+      auto PointerObj = getVariable(PointerOp, Strategy);
+      handleOperand(Access.StoredValue, [&](const auto *ValueOp) {
+        auto ValueObj = getVariable(ValueOp, Strategy);
+        addEdge(Strategy, ValueObj, PointerObj, StorePOI{}, Access.Instr);
+      });
+      addEdge(Strategy, PointerObj, DstObj, Load{}, Access.Instr);
+    });
+  }
 
+  void handleLoad(LLVMPBStrategyRef Strategy, const llvm::LoadInst *Ld,
+                  const LLVMMemoryAccess &Access) {
     if (CurrentMemSSA) {
       llvm::SmallPtrSet<const llvm::StoreInst *, 4> Defs;
       const bool HasLiveOnEntry = collectReachingDefs(Ld, *CurrentMemSSA, Defs);
@@ -334,7 +365,7 @@ struct [[clang::internal_linkage]] LLVMPAGBuilder::PAGBuildData {
           const auto *ValueOp = (*Defs.begin())->getValueOperand();
           if (!llvm::isa<llvm::ConstantExpr>(ValueOp) &&
               !definitelyContainsNoPointer(ValueOp)) {
-            VC.addAlias(Ld, getVariable(ValueOp, Strategy));
+            addAliasOrEquate(Strategy, Ld, getVariable(ValueOp, Strategy), Ld);
             return;
           }
         }
@@ -357,13 +388,13 @@ struct [[clang::internal_linkage]] LLVMPAGBuilder::PAGBuildData {
       }
     }
 
-    handleOperand(Ld->getPointerOperand(), [&](const auto *PointerOp) {
+    handleOperand(Access.Pointer, [&](const auto *PointerOp) {
       auto PointerObj = getVariable(PointerOp, Strategy);
 
       const auto ReuseOrCreate = [&](auto &Map, auto Key) {
         auto [It, Inserted] = Map.try_emplace(Key, ValueId{});
         if (!Inserted) {
-          VC.addAlias(Ld, It->second);
+          addAliasOrEquate(Strategy, Ld, It->second, Ld);
           return;
         }
         auto LoadObj = getVariable(Ld, Strategy);
@@ -399,7 +430,7 @@ struct [[clang::internal_linkage]] LLVMPAGBuilder::PAGBuildData {
       }
     }
 
-    VC.addAlias(Cast, OperandObj);
+    addAliasOrEquate(Strategy, Cast, OperandObj, nullptr);
   }
 
   void handleCast(LLVMPBStrategyRef Strategy, const llvm::User *Cast) {
@@ -424,7 +455,7 @@ struct [[clang::internal_linkage]] LLVMPAGBuilder::PAGBuildData {
           auto [It, Inserted] =
               LocalGeps[PointerOp].try_emplace(Offset.getSExtValue());
           if (!Inserted) {
-            VC.addAlias(Gep, It->second);
+            addAliasOrEquate(Strategy, Gep, It->second, nullptr);
             return;
           }
 
@@ -539,7 +570,8 @@ struct [[clang::internal_linkage]] LLVMPAGBuilder::PAGBuildData {
     llvm::SmallVector<llvm::SmallDenseSet<ValueId>> Args;
     for (const auto &Arg : Call->args()) {
       auto &ArgVal = Args.emplace_back();
-      if (definitelyContainsNoPointer(Arg)) {
+      if (definitelyContainsNoPointer(Arg) &&
+          !PunnedABI.isCoercedPointer(Arg.get(), Call->getFunction())) {
         continue;
       }
 
@@ -549,7 +581,8 @@ struct [[clang::internal_linkage]] LLVMPAGBuilder::PAGBuildData {
     }
 
     std::optional<ValueId> CSVal;
-    if (!definitelyContainsNoPointer(Call)) {
+    if (!definitelyContainsNoPointer(Call) ||
+        PunnedABI.isCoercedPointer(Call, Call->getFunction())) {
       CSVal = getVariable(Call, Strategy);
     }
 
@@ -564,7 +597,8 @@ struct [[clang::internal_linkage]] LLVMPAGBuilder::PAGBuildData {
 
   void handleReturn(LLVMPBStrategyRef Strategy, const llvm::ReturnInst *Ret) {
     const auto *RetVal = Ret->getReturnValue();
-    if (!RetVal || definitelyContainsNoPointer(RetVal)) {
+    if (!RetVal || (definitelyContainsNoPointer(RetVal) &&
+                    !PunnedABI.isCoercedPointer(RetVal, Ret->getFunction()))) {
       return;
     }
 
@@ -694,6 +728,14 @@ void psr::LLVMPAGBuilder::buildPAG(const LLVMProjectIRDB &IRDB,
 
   BData.OnlyIncomingStoresAndOutgoingLoads.reserve(NumPossibleValues);
 
+  // Strategies index their per-value tables by ValueId, so they must see every
+  // id, including those a pre-populated VC already holds.
+  for (const auto &[Id, Vars] : VC.id2vars().enumerate()) {
+    if (!Vars.empty()) {
+      Strategy.onAddValue(Vars.front(), Id);
+    }
+  }
+
   BData.initializeGlobals(IRDB, Strategy);
   BData.initializeFunctions(IRDB, Strategy);
 }
diff --git a/lib/PhasarLLVM/Pointer/LLVMRawAliasSet.cpp b/lib/PhasarLLVM/Pointer/LLVMRawAliasSet.cpp
new file mode 100644
index 0000000000..c275f2796f
--- /dev/null
+++ b/lib/PhasarLLVM/Pointer/LLVMRawAliasSet.cpp
@@ -0,0 +1,125 @@
+#include "phasar/PhasarLLVM/Pointer/LLVMRawAliasSet.h"
+
+#include "phasar/PhasarLLVM/ControlFlow/EntryFunctionUtils.h"
+#include "phasar/PhasarLLVM/ControlFlow/LLVMBasedCallGraph.h"
+#include "phasar/PhasarLLVM/DB/LLVMProjectIRDB.h"
+#include "phasar/PhasarLLVM/Pointer/LLVMAliasSet.h"
+#include "phasar/PhasarLLVM/Pointer/LLVMUnionFindAA.h"
+#include "phasar/PhasarLLVM/TypeHierarchy/DIBasedTypeHierarchy.h"
+#include "phasar/PhasarLLVM/Utils/LLVMShorthands.h"
+#include "phasar/Pointer/AliasInfoBase.h"
+#include "phasar/Utils/AnalysisProperties.h"
+#include "phasar/Utils/EnumFlags.h"
+#include "phasar/Utils/Fn.h"
+#include "phasar/Utils/MaybeUniquePtr.h"
+#include "phasar/Utils/Utilities.h"
+#include "phasar/Utils/ValueCompressor.h"
+
+#include "llvm/IR/InstrTypes.h"
+#include "llvm/IR/Instructions.h"
+
+#include <memory>
+
+using namespace psr;
+
+static_assert(IsAliasInfo<LLVMRawAliasSet>);
+
+LLVMRawAliasSet::LLVMRawAliasSet(const LLVMProjectIRDB *IRDB,
+                                 const LLVMBasedCallGraph &BaseCG, Config Cfg,
+                                 ValueCompressor<PAGVariable> *VC)
+    : Cfg(Cfg) {
+  MaybeUniquePtr<ValueCompressor<PAGVariable>> VCOwn = VC;
+  if (!VC) {
+    VCOwn = std::make_unique<ValueCompressor<PAGVariable>>();
+  }
+
+  auto MakeAAResModel =
+      [&, IRDB, Cfg, VCOwn = std::move(VCOwn)](
+          auto AAResCtor) mutable -> std::unique_ptr<AAResultConcept> {
+    auto AARes = AAResCtor(*IRDB, BaseCG, VCOwn.get());
+    using AAResT = decltype(AARes);
+
+    if (Cfg.ALocality == AnalysisLocality::FunctionLocal) {
+      const auto &VCRef = *VCOwn;
+      return std::make_unique<
+          AAResultModel<LLVMLocalRawAliasIteratorMixin, AAResT>>(
+          std::move(VCOwn), PSR_FWD(AARes), VCRef);
+    }
+
+    return std::make_unique<AAResultModel<LLVMRawAliasIteratorMixin, AAResT>>(
+        std::move(VCOwn), PSR_FWD(AARes));
+  };
+
+  scope_exit ResizeAliasSetCache = [&] {
+    if (!AARes) {
+      // Something went wrong and we hopefully have an in-flight
+      // exception...
+      return;
+    }
+
+    AliasSets.resize(AARes->VC->size());
+  };
+
+  switch (Cfg.AType) {
+  case UnionFindAliasAnalysisType::CtxSens:
+    Props = AnalysisProperties::ContextSensitive;
+    AARes = MakeAAResModel(fn<computeCtxSensUnionFindAARaw>);
+    return;
+  case UnionFindAliasAnalysisType::IndSens:
+    Props = AnalysisProperties::FieldSensitive;
+    AARes = MakeAAResModel(fn<computeIndSensUnionFindAARaw>);
+    return;
+  case UnionFindAliasAnalysisType::CtxIndSens:
+    Props = AnalysisProperties::ContextSensitive |
+            AnalysisProperties::FieldSensitive;
+    AARes = MakeAAResModel(fn<computeCtxIndSensUnionFindAARaw>);
+    return;
+  case UnionFindAliasAnalysisType::BotCtxSens:
+    Props = AnalysisProperties::ContextSensitive;
+    AARes = MakeAAResModel(fn<computeBotCtxSensUnionFindAARaw>);
+    return;
+  case UnionFindAliasAnalysisType::BotCtxIndSens:
+    Props = AnalysisProperties::ContextSensitive |
+            AnalysisProperties::FieldSensitive;
+    AARes = MakeAAResModel(fn<computeBotCtxIndSensUnionFindAARaw>);
+    return;
+  }
+
+  llvm_unreachable(
+      "We should have handled all AnalysisType values in the switch above");
+}
+
+auto LLVMRawAliasSet::getEmptyAliasSet() -> BoxedPtr<AliasSetTy> {
+  static AliasSetTy EmptySet{};
+  static AliasSetTy *EmptySetPtr = &EmptySet;
+  return &EmptySetPtr;
+}
+
+void LLVMRawAliasSet::print(llvm::raw_ostream &OS) const {
+  assert(isValid());
+  // OS << "ValueCompressor: {\n";
+  // for (const auto &[VId, Values] : AARes->VC->id2vars().enumerate()) {
+  //   OS << "  #" << uint32_t(VId) << ":\n";
+  //   for (const auto Val : Values) {
+  //     OS << "    " << to_string(Val) << '\n';
+  //   }
+  // }
+  AARes->print(OS, Cfg);
+}
+
+void LLVMRawAliasSet::printAsJson(llvm::raw_ostream &OS) const {
+  // TODO
+  OS << "{}\n";
+}
+
+[[nodiscard]] llvm::StringRef
+psr::to_string(LLVMRawAliasSet::AnalysisLocality Loc) noexcept {
+  switch (Loc) {
+  case LLVMRawAliasSet::AnalysisLocality::Global:
+    return "global";
+  case LLVMRawAliasSet::AnalysisLocality::FunctionLocal:
+    return "local";
+  }
+  llvm_unreachable(
+      "All analysis-localities should be handled in the switch above");
+}
diff --git a/lib/PhasarLLVM/Pointer/LLVMUnionFindAA.cpp b/lib/PhasarLLVM/Pointer/LLVMUnionFindAA.cpp
index cd0a5ecb41..6c5757d898 100644
--- a/lib/PhasarLLVM/Pointer/LLVMUnionFindAA.cpp
+++ b/lib/PhasarLLVM/Pointer/LLVMUnionFindAA.cpp
@@ -13,9 +13,8 @@ template class CallingContextSensUnionFindAA<LLVMPAGDomain>;
 template class IndirectionSensUnionFindAA<LLVMPAGDomain>;
 template class BottomupUnionFindAA<LLVMPAGDomain>;
 
-detail::LLVMLocalUnionFindAliasIteratorBase::
-    LLVMLocalUnionFindAliasIteratorBase(
-        const ValueCompressor<PAGVariable> &VC) {
+detail::LLVMLocalRawAliasIteratorBase::LLVMLocalRawAliasIteratorBase(
+    const ValueCompressor<PAGVariable> &VC) {
   RawAliasSet<ValueId> Globals;
   for (const auto &[VId, Vars] : VC.id2vars().enumerate()) {
     for (auto V : Vars) {
@@ -70,8 +69,8 @@ BasicUnionFindAAResult psr::computeIndSensUnionFindAARaw(
   return computeUnionFindAARaw(IRDB, std::move(Strategy), std::move(VC));
 }
 
-UnionFindAAResultIntersection<CallingContextSensUnionFindAAResult,
-                              BasicUnionFindAAResult>
+RawAAResultIntersection<CallingContextSensUnionFindAAResult,
+                        BasicUnionFindAAResult>
 psr::computeCtxIndSensUnionFindAARaw(
     const LLVMProjectIRDB &IRDB, const LLVMBasedCallGraph &CG,
     MaybeUniquePtr<ValueCompressor<PAGVariable>> VC) {
@@ -85,7 +84,7 @@ psr::computeCtxIndSensUnionFindAARaw(
   return computeUnionFindAARaw(IRDB, std::move(Strategy), std::move(VC));
 }
 
-UnionFindAAResultIntersection<BasicUnionFindAAResult, BasicUnionFindAAResult>
+RawAAResultIntersection<BasicUnionFindAAResult, BasicUnionFindAAResult>
 psr::computeBotCtxIndSensUnionFindAARaw(
     const LLVMProjectIRDB &IRDB, const LLVMBasedCallGraph &CG,
     MaybeUniquePtr<ValueCompressor<PAGVariable>> VC) {
@@ -101,7 +100,7 @@ psr::computeBotCtxIndSensUnionFindAARaw(
   return computeUnionFindAARaw(IRDB, std::move(Strategy), std::move(VC));
 }
 
-LLVMUnionFindAliasIterator<CallingContextSensUnionFindAAResult>
+LLVMRawAliasIterator<CallingContextSensUnionFindAAResult>
 psr::computeCtxSensUnionFindAA(
     const LLVMProjectIRDB &IRDB, const LLVMBasedCallGraph &CG,
     MaybeUniquePtr<ValueCompressor<PAGVariable>> VC) {
@@ -112,8 +111,7 @@ psr::computeCtxSensUnionFindAA(
   return computeUnionFindAA(IRDB, std::move(Strategy), std::move(VC));
 }
 
-LLVMUnionFindAliasIterator<BasicUnionFindAAResult>
-psr::computeBotCtxSensUnionFindAA(
+LLVMRawAliasIterator<BasicUnionFindAAResult> psr::computeBotCtxSensUnionFindAA(
     const LLVMProjectIRDB &IRDB, const LLVMBasedCallGraph &CG,
     MaybeUniquePtr<ValueCompressor<PAGVariable>> VC) {
   auto Strategy = BottomupUnionFindAA<LLVMPAGDomain>{
@@ -125,8 +123,7 @@ psr::computeBotCtxSensUnionFindAA(
   return computeUnionFindAA(IRDB, std::move(Strategy), std::move(VC));
 }
 
-LLVMUnionFindAliasIterator<BasicUnionFindAAResult>
-psr::computeIndSensUnionFindAA(
+LLVMRawAliasIterator<BasicUnionFindAAResult> psr::computeIndSensUnionFindAA(
     const LLVMProjectIRDB &IRDB, const LLVMBasedCallGraph &CG,
     MaybeUniquePtr<ValueCompressor<PAGVariable>> VC) {
   auto Strategy = pag::PBMixin{
@@ -136,7 +133,7 @@ psr::computeIndSensUnionFindAA(
   return computeUnionFindAA(IRDB, std::move(Strategy), std::move(VC));
 }
 
-LLVMUnionFindAliasIterator<UnionFindAAResultIntersection<
+LLVMRawAliasIterator<RawAAResultIntersection<
     CallingContextSensUnionFindAAResult, BasicUnionFindAAResult>>
 psr::computeCtxIndSensUnionFindAA(
     const LLVMProjectIRDB &IRDB, const LLVMBasedCallGraph &CG,
@@ -151,8 +148,8 @@ psr::computeCtxIndSensUnionFindAA(
   return computeUnionFindAA(IRDB, std::move(Strategy), std::move(VC));
 }
 
-LLVMUnionFindAliasIterator<UnionFindAAResultIntersection<
-    BasicUnionFindAAResult, BasicUnionFindAAResult>>
+LLVMRawAliasIterator<
+    RawAAResultIntersection<BasicUnionFindAAResult, BasicUnionFindAAResult>>
 psr::computeBotCtxIndSensUnionFindAA(
     const LLVMProjectIRDB &IRDB, const LLVMBasedCallGraph &CG,
     MaybeUniquePtr<ValueCompressor<PAGVariable>> VC) {
diff --git a/lib/PhasarLLVM/Pointer/LLVMUnionFindAliasSet.cpp b/lib/PhasarLLVM/Pointer/LLVMUnionFindAliasSet.cpp
deleted file mode 100644
index f022e91bc4..0000000000
--- a/lib/PhasarLLVM/Pointer/LLVMUnionFindAliasSet.cpp
+++ /dev/null
@@ -1,240 +0,0 @@
-#include "phasar/PhasarLLVM/Pointer/LLVMUnionFindAliasSet.h"
-
-#include "phasar/PhasarLLVM/ControlFlow/EntryFunctionUtils.h"
-#include "phasar/PhasarLLVM/ControlFlow/LLVMBasedCallGraph.h"
-#include "phasar/PhasarLLVM/DB/LLVMProjectIRDB.h"
-#include "phasar/PhasarLLVM/Pointer/LLVMAliasSet.h"
-#include "phasar/PhasarLLVM/Pointer/LLVMUnionFindAA.h"
-#include "phasar/PhasarLLVM/TypeHierarchy/DIBasedTypeHierarchy.h"
-#include "phasar/PhasarLLVM/Utils/LLVMShorthands.h"
-#include "phasar/Pointer/AliasInfoBase.h"
-#include "phasar/Pointer/RawAliasSet.h"
-#include "phasar/Utils/AnalysisProperties.h"
-#include "phasar/Utils/EnumFlags.h"
-#include "phasar/Utils/Fn.h"
-#include "phasar/Utils/MaybeUniquePtr.h"
-#include "phasar/Utils/StrongTypeDef.h"
-#include "phasar/Utils/Utilities.h"
-#include "phasar/Utils/ValueCompressor.h"
-
-#include "llvm/IR/Argument.h"
-#include "llvm/IR/InstrTypes.h"
-#include "llvm/IR/Instructions.h"
-#include "llvm/Support/Casting.h"
-
-#include <memory>
-
-using namespace psr;
-
-static_assert(IsAliasInfo<LLVMUnionFindAliasSet>);
-
-static inline bool isPotentialAllocSite(const llvm::Value *Val) {
-  if (!Val->getType()->isPointerTy()) {
-    return false;
-  }
-  if (llvm::isa<llvm::AllocaInst, llvm::Argument>(Val)) {
-    return true;
-  }
-  if (const auto *Call = llvm::dyn_cast<llvm::CallBase>(Val)) {
-    return Call->getCalledFunction() &&
-           psr::isHeapAllocatingFunction(Call->getCalledFunction());
-  }
-  return false;
-}
-
-template <template <typename, typename> typename AAResIterT, typename AAResT>
-struct [[clang::internal_linkage]] LLVMUnionFindAliasSet::UnionFindAAResultModel
-    : public UnionFindAAResultConcept,
-      public AAResIterT<UnionFindAAResultModel<AAResIterT, AAResT>, AAResT> {
-
-  using base_t = AAResIterT<UnionFindAAResultModel<AAResIterT, AAResT>, AAResT>;
-
-  template <typename... ArgsT>
-  constexpr UnionFindAAResultModel(
-      MaybeUniquePtr<const ValueCompressor<PAGVariable>> VC, ArgsT &&...Args)
-      : UnionFindAAResultConcept{std::move(VC)}, base_t{PSR_FWD(Args)...} {}
-
-  void forallAliasesOf(v_t Ptr, n_t Inst,
-                       llvm::function_ref<void(v_t)> Callback) override {
-    this->base_t::forallAliasesOf(Ptr, Inst, Callback);
-  }
-
-  AliasResult alias(v_t Ptr1, v_t Ptr2, n_t AtInstruction = nullptr) override {
-    return this->base_t::alias(Ptr1, Ptr2, AtInstruction);
-  }
-
-  AliasSetPtrTy constructAliasSet(ValueId ValId, n_t Inst,
-                                  AliasSetOwner<AliasSetTy> &Owner) override {
-    auto ASet = Owner.acquire();
-    try {
-      this->base_t::forallAliasesOf(
-          ValId, Inst,
-          [ASet{ASet.get()}](v_t Alias) -> void { ASet->insert(Alias); });
-      return ASet;
-    } catch (...) {
-      Owner.release(ASet.get());
-      throw;
-    }
-  }
-
-  AllocationSiteSetPtrTy constructReachableAllocSites(v_t V, ValueId ValId,
-                                                      bool IntraProcOnly,
-                                                      n_t Inst) override {
-    if (!this->AllocationSites) [[unlikely]] {
-      this->AllocationSites.emplace();
-      for (const auto &[VId, Vars] : this->VC->id2vars().enumerate()) {
-        for (const PAGVariable &Var : Vars) {
-          if (const auto *LLVMVar = Var.valueOrNull();
-              LLVMVar && isPotentialAllocSite(LLVMVar)) {
-            this->AllocationSites->insert(VId);
-            break;
-          }
-        }
-      }
-    }
-
-    auto RawAliases = [&]() -> RawAliasSet<ValueId> {
-      if constexpr (requires() { this->base_t::getRawAliasSet(ValId, Inst); }) {
-        return this->base_t::getRawAliasSet(ValId, Inst);
-      } else {
-        return this->base_t::getRawAliasSet(ValId);
-      }
-    }();
-    RawAliases &= *this->AllocationSites;
-
-    auto Ret = std::make_unique<AliasSetTy>();
-
-    RawAliases.foreach (llvmUnionFindAliasHandler(
-        *this->VC, [&Ret, V, IntraProcOnly](v_t Alias) {
-          if (psr::isInReachableAllocationSitesTy(V, Alias, IntraProcOnly)) {
-            Ret->insert(Alias);
-          }
-        }));
-
-    return Ret;
-  }
-
-  void print(llvm::raw_ostream &OS, Config Cfg) const override {
-    OS << "LLVMUnionFindAliasSet(" << to_string(Cfg.ALocality) << ", "
-       << to_string(Cfg.AType) << ") {\n";
-
-    for (auto ValId : iota<ValueId>(VC->size())) {
-      OS << "  #" << psr::to_underlying(ValId) << ": {";
-      bool First = true;
-      const auto &Aliases = this->base_t::getRawAliasSet(ValId);
-      Aliases.foreach ([&](auto AliasId) {
-        if (First) {
-          First = false;
-        } else {
-          OS << ", ";
-        }
-
-        OS << psr::to_underlying(AliasId);
-      });
-      OS << "}\n";
-    }
-    OS << "}\n";
-  };
-};
-
-LLVMUnionFindAliasSet::LLVMUnionFindAliasSet(const LLVMProjectIRDB *IRDB,
-                                             const LLVMBasedCallGraph &BaseCG,
-                                             Config Cfg,
-                                             ValueCompressor<PAGVariable> *VC)
-    : Cfg(Cfg) {
-  MaybeUniquePtr<ValueCompressor<PAGVariable>> VCOwn = VC;
-  if (!VC) {
-    VCOwn = std::make_unique<ValueCompressor<PAGVariable>>();
-  }
-
-  auto MakeAAResModel =
-      [&, IRDB, Cfg, VCOwn = std::move(VCOwn)](
-          auto AAResCtor) mutable -> std::unique_ptr<UnionFindAAResultConcept> {
-    auto AARes = AAResCtor(*IRDB, BaseCG, VCOwn.get());
-    using AAResT = decltype(AARes);
-
-    if (Cfg.ALocality == AnalysisLocality::FunctionLocal) {
-      const auto &VCRef = *VCOwn;
-      return std::make_unique<
-          UnionFindAAResultModel<LLVMLocalUnionFindAliasIteratorMixin, AAResT>>(
-          std::move(VCOwn), PSR_FWD(AARes), VCRef);
-    }
-
-    return std::make_unique<
-        UnionFindAAResultModel<LLVMUnionFindAliasIteratorMixin, AAResT>>(
-        std::move(VCOwn), PSR_FWD(AARes));
-  };
-
-  scope_exit ResizeAliasSetCache = [&] {
-    if (!AARes) {
-      // Something went wrong and we hopefully have an in-flight
-      // exception...
-      return;
-    }
-
-    AliasSets.resize(AARes->VC->size());
-  };
-
-  switch (Cfg.AType) {
-  case UnionFindAliasAnalysisType::CtxSens:
-    Props = AnalysisProperties::ContextSensitive;
-    AARes = MakeAAResModel(fn<computeCtxSensUnionFindAARaw>);
-    return;
-  case UnionFindAliasAnalysisType::IndSens:
-    Props = AnalysisProperties::FieldSensitive;
-    AARes = MakeAAResModel(fn<computeIndSensUnionFindAARaw>);
-    return;
-  case UnionFindAliasAnalysisType::CtxIndSens:
-    Props = AnalysisProperties::ContextSensitive |
-            AnalysisProperties::FieldSensitive;
-    AARes = MakeAAResModel(fn<computeCtxIndSensUnionFindAARaw>);
-    return;
-  case UnionFindAliasAnalysisType::BotCtxSens:
-    Props = AnalysisProperties::ContextSensitive;
-    AARes = MakeAAResModel(fn<computeBotCtxSensUnionFindAARaw>);
-    return;
-  case UnionFindAliasAnalysisType::BotCtxIndSens:
-    Props = AnalysisProperties::ContextSensitive |
-            AnalysisProperties::FieldSensitive;
-    AARes = MakeAAResModel(fn<computeBotCtxIndSensUnionFindAARaw>);
-    return;
-  }
-
-  llvm_unreachable(
-      "We should have handled all AnalysisType values in the switch above");
-}
-
-auto LLVMUnionFindAliasSet::getEmptyAliasSet() -> BoxedPtr<AliasSetTy> {
-  static AliasSetTy EmptySet{};
-  static AliasSetTy *EmptySetPtr = &EmptySet;
-  return &EmptySetPtr;
-}
-
-void LLVMUnionFindAliasSet::print(llvm::raw_ostream &OS) const {
-  assert(isValid());
-  // OS << "ValueCompressor: {\n";
-  // for (const auto &[VId, Values] : AARes->VC->id2vars().enumerate()) {
-  //   OS << "  #" << uint32_t(VId) << ":\n";
-  //   for (const auto Val : Values) {
-  //     OS << "    " << to_string(Val) << '\n';
-  //   }
-  // }
-  AARes->print(OS, Cfg);
-}
-
-void LLVMUnionFindAliasSet::printAsJson(llvm::raw_ostream &OS) const {
-  // TODO
-  OS << "{}\n";
-}
-
-[[nodiscard]] llvm::StringRef
-psr::to_string(LLVMUnionFindAliasSet::AnalysisLocality Loc) noexcept {
-  switch (Loc) {
-  case LLVMUnionFindAliasSet::AnalysisLocality::Global:
-    return "global";
-  case LLVMUnionFindAliasSet::AnalysisLocality::FunctionLocal:
-    return "local";
-  }
-  llvm_unreachable(
-      "All analysis-localities should be handled in the switch above");
-}
diff --git a/lib/PhasarLLVM/Pointer/Pointer.cppm b/lib/PhasarLLVM/Pointer/Pointer.cppm
index 4ee1f0d16e..0a374c43a0 100644
--- a/lib/PhasarLLVM/Pointer/Pointer.cppm
+++ b/lib/PhasarLLVM/Pointer/Pointer.cppm
@@ -33,13 +33,15 @@ using psr::LLVMAliasInfoRef;
 using psr::LLVMAliasIteratorRef;
 using psr::LLVMAliasSet;
 using psr::LLVMAliasSetData;
+using psr::LLVMLocalRawAliasIterator;
+using psr::LLVMLocalRawAliasIteratorMixin;
 using psr::LLVMLocalUnionFindAliasIterator;
-using psr::LLVMLocalUnionFindAliasIteratorMixin;
 using psr::LLVMPointsToIterator;
 using psr::LLVMPointsToIteratorRef;
-using psr::llvmUnionFindAliasHandler;
+using psr::llvmRawAliasHandler;
+using psr::LLVMRawAliasIterator;
+using psr::LLVMRawAliasIteratorMixin;
 using psr::LLVMUnionFindAliasIterator;
-using psr::LLVMUnionFindAliasIteratorMixin;
 using psr::MemSSABundle;
 using psr::pag::LLVMCGProvider;
 
diff --git a/lib/Pointer/UnionFindAA.cpp b/lib/Pointer/UnionFindAA.cpp
index a14d6cfcdf..31f807362d 100644
--- a/lib/Pointer/UnionFindAA.cpp
+++ b/lib/Pointer/UnionFindAA.cpp
@@ -7,7 +7,7 @@ using namespace psr;
 
 void psr::UnionFindAAResultBase::dump(llvm::raw_ostream &OS,
                                       uint32_t Indent) const {
-  OS.indent(Indent) << "UnionFindAAResult {\n";
+  OS.indent(Indent) << "RawAAResult {\n";
 
   for (const auto &[RepId, Aliases] : BackwardView.enumerate()) {
     OS.indent(Indent + 2) << "#" << psr::to_underlying(RepId) << ": <";
diff --git a/test/llvm_test_code/pointers/CMakeLists.txt b/test/llvm_test_code/pointers/CMakeLists.txt
index 3096d1812f..35e44352fc 100644
--- a/test/llvm_test_code/pointers/CMakeLists.txt
+++ b/test/llvm_test_code/pointers/CMakeLists.txt
@@ -21,6 +21,9 @@ set(lca_files
   andersen_otf_fnptr_table_dynamic_index.c
   andersen_otf_fnptr_table_indirect_value.c
   andersen_otf_fnptr_table_memcpy.c
+  andersen_otf_aggregate_ret.c
+  andersen_otf_atomics.c
+  pointer_punning_01.c
   global_01.cpp
   inter_dynamic_01.cpp
   inter_dynamic_02.cpp
@@ -48,6 +51,9 @@ set(lca_files
   context_14_0.c
   context_14_1.c
   context_14_2.c
+  context_15.c
+  context_16.c
+  context_17.c
   indirection_01.c
   indirection_02.c
   indirection_03.c
@@ -60,6 +66,8 @@ set(lca_files
   indirection_10.cpp
   memssa_kill_01.c
   memssa_branch_01.c
+  memssa_constexpr_def.c
+  loop_carried_load.c
 )
 
 set(lca_files_mem2reg
@@ -67,6 +75,10 @@ set(lca_files_mem2reg
   andersen_otf_fp.c
   andersen_otf_libc.c
   andersen_otf_struct_vtable.c
+  andersen_otf_poison_scc.c
+  andersen_otf_loop_gep.c
+  andersen_otf_stranded_pending.c
+  loop_carried_load.c
   basic_01.c
   basic_02.c
   basic_03.c
diff --git a/test/llvm_test_code/pointers/andersen_otf_aggregate_ret.c b/test/llvm_test_code/pointers/andersen_otf_aggregate_ret.c
new file mode 100644
index 0000000000..2798c0ca9a
--- /dev/null
+++ b/test/llvm_test_code/pointers/andersen_otf_aggregate_ret.c
@@ -0,0 +1,21 @@
+// make() returns { ptr, i64 }.  handleReturn populates its
+// return slot, but handleCall only binds the call result for pointer-typed
+// calls and there is no extractvalue case, so B never learns about A.
+struct Pair {
+  int *P;
+  long N;
+};
+
+struct Pair make(int *X) {
+  struct Pair R;
+  R.P = X;
+  R.N = 1;
+  return R;
+}
+
+int main() {
+  int A = 0;
+  struct Pair Q = make(&A);
+  int *B = Q.P;
+  return *B;
+}
diff --git a/test/llvm_test_code/pointers/andersen_otf_atomics.c b/test/llvm_test_code/pointers/andersen_otf_atomics.c
new file mode 100644
index 0000000000..c4b319373e
--- /dev/null
+++ b/test/llvm_test_code/pointers/andersen_otf_atomics.c
@@ -0,0 +1,13 @@
+// Check that the analysis handles atomic operations properly; Note: Clang
+// treats the Q argument below as i64, not as ptr
+int main() {
+  int A = 0;
+  int B = 0;
+  int *P = &A;
+  int *Q = &B;
+  int *Old = __atomic_exchange_n(&P, Q, __ATOMIC_SEQ_CST);
+  int *Cur = P;
+  int *U = Old;
+  int *V = Cur;
+  return *U + *V;
+}
diff --git a/test/llvm_test_code/pointers/andersen_otf_fnptr_table_memcpy.c b/test/llvm_test_code/pointers/andersen_otf_fnptr_table_memcpy.c
index 798fff6b1a..958d42e1a7 100644
--- a/test/llvm_test_code/pointers/andersen_otf_fnptr_table_memcpy.c
+++ b/test/llvm_test_code/pointers/andersen_otf_fnptr_table_memcpy.c
@@ -1,6 +1,6 @@
 #include <stdlib.h>
 
-// Minimized spec-mesa pattern: H->A and H->B alias H (field-insensitively),
+// H->A and H->B alias H (field-insensitively),
 // only H->B is initialized, then H->A = H->B (an llvm.memcpy). Each field's
 // call through H->A must still resolve to only its own function.
 struct Ops {
diff --git a/test/llvm_test_code/pointers/andersen_otf_loop_gep.c b/test/llvm_test_code/pointers/andersen_otf_loop_gep.c
new file mode 100644
index 0000000000..acde8a8af5
--- /dev/null
+++ b/test/llvm_test_code/pointers/andersen_otf_loop_gep.c
@@ -0,0 +1,17 @@
+// After mem2reg the loop pointer is a PHI whose second
+// incoming value is the GEP below.  handlePhi interns the GEP first, so
+// addPtrAlias's addAlias() call fails and the GEP node keeps an empty
+// points-to set instead of aliasing Buf.
+char *findEnd(char *Buf) {
+  char *P = Buf;
+  while (*P != 0) {
+    P = P + 1;
+  }
+  return P;
+}
+
+int main() {
+  char Buf[16];
+  char *E = findEnd(Buf);
+  return *E;
+}
diff --git a/test/llvm_test_code/pointers/andersen_otf_poison_scc.c b/test/llvm_test_code/pointers/andersen_otf_poison_scc.c
new file mode 100644
index 0000000000..0685b470ee
--- /dev/null
+++ b/test/llvm_test_code/pointers/andersen_otf_poison_scc.c
@@ -0,0 +1,46 @@
+#include <stdlib.h>
+
+// The disqualifying store in pong() records its pointer node
+// unresolved.  LCD collapses that node into the ping/pong SCC, and the
+// re-check reads the cleared non-representative, so O is never poisoned and
+// call_fn stays wrongly precise at {real_fn}.
+struct Ops {
+  void (*Fn)(void);
+};
+
+void real_fn(void) {}
+void other_fn(void) {}
+
+static void (*Hook)(struct Ops *);
+
+struct Ops *ping(struct Ops *o, void (*f)(void));
+
+// pong's formal is created after ping's, so it becomes the non-rep.
+struct Ops *pong(struct Ops *o, void (*f)(void)) {
+  o->Fn = f;
+  return ping(o, f);
+}
+
+struct Ops *ping(struct Ops *o, void (*f)(void)) { return pong(o, f); }
+
+void deliver(struct Ops *o) { ping(o, other_fn); }
+
+void call_fn(struct Ops *o) { (*o->Fn)(); }
+
+int main() {
+  struct Ops *O = (struct Ops *)malloc(sizeof(struct Ops));
+  O->Fn = real_fn;
+  Hook = deliver;
+
+  // Drive one wave through the ping/pong cycle so LCD collapses it while O
+  // is still absent from the formals' points-to sets.
+  struct Ops *Seed = (struct Ops *)malloc(sizeof(struct Ops));
+  ping(Seed, other_fn);
+
+  // Indirect through a load of Hook: deliver(O) is only connected in a later
+  // round, so O reaches the collapsed formals after the merge.
+  (*Hook)(O);
+
+  call_fn(O);
+  return 0;
+}
diff --git a/test/llvm_test_code/pointers/andersen_otf_stranded_pending.c b/test/llvm_test_code/pointers/andersen_otf_stranded_pending.c
new file mode 100644
index 0000000000..2bb7fed9b1
--- /dev/null
+++ b/test/llvm_test_code/pointers/andersen_otf_stranded_pending.c
@@ -0,0 +1,28 @@
+// merge() strands the absorbed pts diff in Rep's PendingPts.
+// handlePhi interns the loop-carried GEP first, so its still-empty node wins
+// the union-find join over the load it is later merged with -- and
+// addAssignEdge re-marks Rep's pts only when that pts is non-empty.
+struct Node {
+  struct Node *Next;
+};
+
+struct Node Obj;
+
+void sink(struct Node *P) { (void)P; }
+
+struct Node *walk(struct Node **Slot, struct Node *Init, int N) {
+  struct Node *P = Init;
+  for (int I = 0; I < N; ++I) {
+    struct Node *Base = *Slot;
+    sink(P); // forces a propagate(), so Base has pointees at the GEP below
+    P = Base + 1;
+  }
+  return P;
+}
+
+int main(int argc, char **argv) {
+  struct Node Local;
+  struct Node *Slot = &Local;
+  struct Node *R = walk(&Slot, &Obj, argc);
+  return R != 0;
+}
diff --git a/test/llvm_test_code/pointers/context_15.c b/test/llvm_test_code/pointers/context_15.c
new file mode 100644
index 0000000000..968366f3fb
--- /dev/null
+++ b/test/llvm_test_code/pointers/context_15.c
@@ -0,0 +1,26 @@
+
+// The spec-mesa end() pattern: one helper called from two sites, dispatching
+// through a function-pointer field of its parameter.  Context-insensitively
+// both call sites merge into end's formals, so each dispatch sees both
+// targets and both call results alias.
+struct Ops {
+  void *(*Get)(void *);
+};
+
+static void *first(void *P) { return P; }
+static void *second(void *P) { return P; }
+
+static const struct Ops O1 = {&first};
+static const struct Ops O2 = {&second};
+
+static void *end(const struct Ops *O, void *P) { return O->Get(P); }
+
+int main() {
+  int x = 42;
+  int y = 43;
+
+  void *xx = end(&O1, &x);
+  void *yy = end(&O2, &y);
+
+  return xx == yy;
+}
diff --git a/test/llvm_test_code/pointers/context_16.c b/test/llvm_test_code/pointers/context_16.c
new file mode 100644
index 0000000000..857b90e417
--- /dev/null
+++ b/test/llvm_test_code/pointers/context_16.c
@@ -0,0 +1,28 @@
+
+// A dispatch table filled in by a shared helper, called from two contexts.
+// Context-insensitively the two tables are one object, so both call sites see
+// both callees (FnPtrFieldWrites keys on the allocation site alone).
+#include <stdlib.h>
+
+struct Table {
+  void (*Fn)(void);
+};
+
+static void red(void) {}
+static void blue(void) {}
+
+static struct Table *make(void (*Fn)(void)) {
+  struct Table *T = malloc(sizeof(struct Table));
+  T->Fn = Fn;
+  return T;
+}
+
+int main() {
+  struct Table *A = make(&red);
+  struct Table *B = make(&blue);
+
+  A->Fn();
+  B->Fn();
+
+  return 0;
+}
diff --git a/test/llvm_test_code/pointers/context_17.c b/test/llvm_test_code/pointers/context_17.c
new file mode 100644
index 0000000000..ef2fac1aaa
--- /dev/null
+++ b/test/llvm_test_code/pointers/context_17.c
@@ -0,0 +1,18 @@
+
+// Mutual recursion: ping and pong call each other and are both reached from
+// two call sites in main.  Exercises context-string truncation (k = 1) -- the
+// solver must terminate and stay sound.
+static int *pong(int *P);
+
+static int *ping(int *P) { return P ? pong(P) : P; }
+static int *pong(int *P) { return P ? ping(P) : P; }
+
+int main() {
+  int x = 42;
+  int y = 43;
+
+  int *xx = ping(&x);
+  int *yy = ping(&y);
+
+  return xx == yy;
+}
diff --git a/test/llvm_test_code/pointers/loop_carried_load.c b/test/llvm_test_code/pointers/loop_carried_load.c
new file mode 100644
index 0000000000..3179b228f9
--- /dev/null
+++ b/test/llvm_test_code/pointers/loop_carried_load.c
@@ -0,0 +1,16 @@
+// After mem2reg the loop pointer is a PHI whose second incoming value is the
+// load below. handlePhi interns the load first, so handleLoad's addAlias()
+// no-ops and -- on the single-reaching-def MemSSA path -- the load is left
+// without any incoming edge at all, aliasing nothing.
+int A;
+int B;
+int *Slot;
+
+int main(int Argc, char **Argv) {
+  Slot = &A;
+  int *P = &B;
+  for (int I = 0; I < Argc; ++I) {
+    P = Slot;
+  }
+  return *P;
+}
diff --git a/test/llvm_test_code/pointers/memssa_constexpr_def.c b/test/llvm_test_code/pointers/memssa_constexpr_def.c
new file mode 100644
index 0000000000..0cf342d59a
--- /dev/null
+++ b/test/llvm_test_code/pointers/memssa_constexpr_def.c
@@ -0,0 +1,15 @@
+// The single reaching def of the load stores a ConstantExpr GEP. That value
+// cannot be aliased with, but its leaves can still be assigned from, so R must
+// get A only -- not the B that the indirect store also put into P.
+int A[4];
+int B[4];
+int *P;
+int *Q;
+
+int main(int Argc, char **Argv) {
+  int **Sel = Argc ? &P : &Q;
+  *Sel = &B[1];
+  P = &A[2];
+  int *R = P;
+  return *R;
+}
diff --git a/test/llvm_test_code/pointers/pointer_punning_01.c b/test/llvm_test_code/pointers/pointer_punning_01.c
new file mode 100644
index 0000000000..d53805ebab
--- /dev/null
+++ b/test/llvm_test_code/pointers/pointer_punning_01.c
@@ -0,0 +1,14 @@
+// A pointer-sized integer view of a pointer-holding slot. Both the store and
+// the load are typed i64, so the plain integer-type gate would drop the whole
+// chain and Q would alias nothing.
+#include <stdint.h>
+
+int A;
+int B;
+
+int main() {
+  int *P = &A;
+  *(intptr_t *)&P = (intptr_t)&B;
+  int *Q = (int *)*(intptr_t *)&P;
+  return *Q;
+}
diff --git a/tools/ptaben/PTAUtils.h b/tools/ptaben/PTAUtils.h
index 4110da1d57..d03518d620 100755
--- a/tools/ptaben/PTAUtils.h
+++ b/tools/ptaben/PTAUtils.h
@@ -10,11 +10,14 @@
  *****************************************************************************/
 
 #include "phasar/Pointer/AliasResult.h"
+#include "phasar/Utils/TypeTraits.h"
+#include "phasar/Utils/Utilities.h"
 
 #include "llvm/ADT/SmallVector.h"
 #include "llvm/ADT/StringRef.h"
 #include "llvm/ADT/Twine.h"
 #include "llvm/Support/FileSystem.h"
+#include "llvm/Support/WithColor.h"
 
 #include "QueryLocation.h"
 
@@ -51,9 +54,10 @@ void findAllQueryLocations(
                                         const QueryLocation &QueryLoc);
 
 template <typename CheckFn>
-std::enable_if_t<std::is_invocable_r_v<bool, CheckFn, llvm::StringRef>>
-checkDir(const llvm::Twine &DirName,
-         llvm::SmallVectorImpl<std::string> &Failures, CheckFn Check) {
+size_t checkDir(const llvm::Twine &DirName,
+                llvm::SmallVectorImpl<std::string> &Failures, CheckFn Check)
+  requires(std::is_invocable_r_v<bool, CheckFn, llvm::StringRef>)
+{
   std::error_code EC;
   llvm::sys::fs::recursive_directory_iterator It(DirName, EC, false);
   llvm::sys::fs::recursive_directory_iterator End;
@@ -76,10 +80,24 @@ checkDir(const llvm::Twine &DirName,
     }
   }
 
-  llvm::outs() << "Analyzed " << NumTests << " Benchmark files\n";
-
   if (EC) {
-    llvm::errs() << "[ERROR]: " << EC.message() << '\n';
+    llvm::WithColor::error() << EC.message() << '\n';
   }
+
+  return NumTests;
+}
+
+template <typename CheckFn>
+void checkDirs(is_iterable_over_v<llvm::StringRef> auto &&DirNames,
+               llvm::SmallVectorImpl<std::string> &Failures, CheckFn Check)
+  requires(std::is_invocable_r_v<bool, CheckFn, llvm::StringRef>)
+{
+
+  size_t NumTests = 0;
+  for (const auto &Path : DirNames) {
+    NumTests += checkDir(Path, Failures, copyOrRef(Check));
+  }
+
+  llvm::outs() << "Analyzed " << NumTests << " Benchmark files\n";
 }
 } // namespace psr::ptaben
diff --git a/tools/ptaben/SupportedAnalysisTypes.def b/tools/ptaben/SupportedAnalysisTypes.def
index 1ca91aa46e..3bb93b195d 100644
--- a/tools/ptaben/SupportedAnalysisTypes.def
+++ b/tools/ptaben/SupportedAnalysisTypes.def
@@ -19,5 +19,7 @@ PSR_PTABEN_SUPPORTED_ANALYSIS_TYPES(UFAACtxInd, "ctx-ind-table", "ctx-ind-result
 PSR_PTABEN_SUPPORTED_ANALYSIS_TYPES(UFAABotCtx, "bot-table", "bot-results.csv")
 PSR_PTABEN_SUPPORTED_ANALYSIS_TYPES(UFAABotCtxInd, "bot-ctx-ind-table", "bot-ctx-ind-results.csv")
 PSR_PTABEN_SUPPORTED_ANALYSIS_TYPES(AndersOTF, "anders-otf-table", "anders-otf-results.csv")
+PSR_PTABEN_SUPPORTED_ANALYSIS_TYPES(AndersOTFCtxDyn, "anders-otf-ctx-dyn-table", "anders-otf-ctx-dyn-results.csv")
+PSR_PTABEN_SUPPORTED_ANALYSIS_TYPES(AndersOTFCtxAll, "anders-otf-ctx-all-table", "anders-otf-ctx-all-results.csv")
 
 #undef PSR_PTABEN_SUPPORTED_ANALYSIS_TYPES
diff --git a/tools/ptaben/ptaben_benchmark_tool.cpp b/tools/ptaben/ptaben_benchmark_tool.cpp
index db78a8a267..4ed492a82f 100644
--- a/tools/ptaben/ptaben_benchmark_tool.cpp
+++ b/tools/ptaben/ptaben_benchmark_tool.cpp
@@ -48,10 +48,15 @@ static cl::OptionCategory PTABenCat("PTABen Benchmark Tool");
 static cl::SubCommand
     CheckFileCmd("check-file", "Check a single file instead of a directory");
 
-static cl::opt<std::string> IRPath(cl::Positional, cl::Required,
-                                   cl::desc("ptaben-ir-directory"),
-                                   cl::cat(PTABenCat),
-                                   cl::sub(cl::SubCommand::getAll()));
+static cl::list<std::string> IRPaths(cl::Positional, cl::OneOrMore,
+                                     cl::desc("ptaben-ir-directory"),
+                                     cl::cat(PTABenCat),
+                                     cl::sub(cl::SubCommand::getTopLevel()));
+
+static cl::opt<std::string> IRFilePath(cl::Positional, cl::Required,
+                                       cl::desc("ptaben-ir-file"),
+                                       cl::cat(PTABenCat),
+                                       cl::sub(CheckFileCmd));
 static cl::opt<std::string>
     QueryTablePath("queries-table",
                    cl::desc("The Output-Path to the queries table"),
@@ -71,6 +76,8 @@ ufaaTypeFromSupported(SupportedAnalysisTypes AT) {
   case SupportedAnalysisTypes::CFLAnders:
   case SupportedAnalysisTypes::CFLSteens:
   case SupportedAnalysisTypes::AndersOTF:
+  case SupportedAnalysisTypes::AndersOTFCtxDyn:
+  case SupportedAnalysisTypes::AndersOTFCtxAll:
     llvm::report_fatal_error("Not a union-find analysis");
   case SupportedAnalysisTypes::UFAACtx:
     return psr::UnionFindAliasAnalysisType::CtxSens;
@@ -96,7 +103,7 @@ checkLLVMQueryLoc(psr::LLVMAliasInfoRef ComputedAliasResult,
 
 template <typename AAResT>
 static psr::AliasResult
-checkLLVMQueryLoc(psr::LLVMUnionFindAliasIterator<AAResT> &ComputedAliasResult,
+checkLLVMQueryLoc(psr::LLVMRawAliasIterator<AAResT> &ComputedAliasResult,
                   const llvm::Instruction *QueryInst) {
   const auto *Ptr1 = QueryInst->getOperand(0);
   const auto *Ptr2 = QueryInst->getOperand(1);
@@ -148,11 +155,14 @@ static void performUnionFindAliasAnalysis(
 static void
 performAndersenOTFAA(psr::LLVMProjectIRDB &IRDB,
                      llvm::ArrayRef<psr::ptaben::QueryLocation> QueryLocs,
-                     auto &&RC) {
+                     auto &&RC, psr::ContextSensitivityOptions::Mode CtxMode) {
   auto EntryFunctions =
       getEntryFunctions(IRDB, psr::getDefaultEntryPoints(IRDB));
   auto VC = psr::ValueCompressor<psr::PAGVariable>();
-  auto AARes = psr::computeAndersenOTF(IRDB, EntryFunctions, &VC);
+  psr::ContextSensitivityOptions CSOpts;
+  CSOpts.SelectionMode = CtxMode;
+  auto AARes = psr::computeAndersenOTF(
+      IRDB, EntryFunctions, &VC, psr::Soundness::Soundy, std::move(CSOpts));
 
   for (const auto &Loc : QueryLocs) {
     auto Res = checkLLVMQueryLoc(AARes, Loc.Inst);
@@ -178,7 +188,14 @@ performAnalysis(psr::LLVMProjectIRDB &IRDB,
     return performUnionFindAliasAnalysis(IRDB, BaseCG, QueryLocs, PSR_FWD(RC),
                                          ufaaTypeFromSupported(AType));
   case SupportedAnalysisTypes::AndersOTF:
-    return performAndersenOTFAA(IRDB, QueryLocs, PSR_FWD(RC));
+    return performAndersenOTFAA(IRDB, QueryLocs, PSR_FWD(RC),
+                                psr::ContextSensitivityOptions::Mode::Off);
+  case SupportedAnalysisTypes::AndersOTFCtxDyn:
+    return performAndersenOTFAA(IRDB, QueryLocs, PSR_FWD(RC),
+                                psr::ContextSensitivityOptions::Mode::Dynamic);
+  case SupportedAnalysisTypes::AndersOTFCtxAll:
+    return performAndersenOTFAA(IRDB, QueryLocs, PSR_FWD(RC),
+                                psr::ContextSensitivityOptions::Mode::All);
   }
 }
 
@@ -191,9 +208,9 @@ static auto openFileOrExit(llvm::StringRef Filepath) {
 }
 
 static int checkSingleFile() {
-  llvm::WithColor::note() << "Analyzing " << IRPath << '\n';
+  llvm::WithColor::note() << "Analyzing " << IRFilePath << '\n';
 
-  auto IRDB = psr::LLVMProjectIRDB::loadOrExit(IRPath);
+  auto IRDB = psr::LLVMProjectIRDB::loadOrExit(IRFilePath);
   auto *Mod = IRDB.getModule();
   assert(Mod != nullptr);
   llvm::SmallVector<psr::ptaben::QueryLocation, 4> QueryLocs;
@@ -293,7 +310,8 @@ static int performCompleteExperiment() {
                 }};
 
   llvm::SmallVector<std::string, 4> Failures;
-  psr::ptaben::checkDir(IRPath, Failures, [&](llvm::StringRef FileName) {
+
+  psr::ptaben::checkDirs(IRPaths, Failures, [&](llvm::StringRef FileName) {
     llvm::WithColor::note() << "Analyzing " << FileName << '\n';
 
     auto IRDB = psr::LLVMProjectIRDB::loadOrExit(FileName);
@@ -325,6 +343,7 @@ static int performCompleteExperiment() {
 
     return true;
   });
+
   return 0;
 }
 
diff --git a/unittests/.clang-tidy b/unittests/.clang-tidy
index 363c8aa2a3..cf0f77100c 100644
--- a/unittests/.clang-tidy
+++ b/unittests/.clang-tidy
@@ -1,10 +1,8 @@
-Checks: '-*,
-         clang-diagnostic-*,
-         llvm-*,
-         misc-*,
+InheritParentConfig: true
+
+Checks: >
            -misc-non-private-member-variables-in-classes,
            -misc-no-recursion,
-         readability-*,
            -readability-else-after*,
            -readability-simplify-boolean-expr,
            -readability-implicit-bool-cast,
@@ -13,7 +11,6 @@ Checks: '-*,
            -readability-magic-numbers,
            -readability-function-cognitive-complexity,
            -readability-convert-member-functions-to-static,
-         cppcoreguidelines-*,
            -cppcoreguidelines-avoid-non-const-global-variables,
            -cppcoreguidelines-pro-bounds-array-to-pointer-decay,
            -cppcoreguidelines-owning-memory,
@@ -22,14 +19,10 @@ Checks: '-*,
            -cppcoreguidelines-non-private-member-variables-in-classes,
            -cppcoreguidelines-init-variables,
            -cppcoreguidelines-macro-usage,
-         bugprone-*,
            -bugprone-easily-swappable-parameters,
-         modernize-*,
            -modernize-use-trailing-return-type,
-           -modernize-pass-by-value,
-         performance-*,
-         clang-analyzer-*,
-        '
+           -modernize-pass-by-value
+
 
 FormatStyle:  LLVM
 
diff --git a/unittests/PhasarLLVM/Pointer/AndersenOTFAATest.cpp b/unittests/PhasarLLVM/Pointer/AndersenOTFAATest.cpp
index d025fff80a..2973c78deb 100644
--- a/unittests/PhasarLLVM/Pointer/AndersenOTFAATest.cpp
+++ b/unittests/PhasarLLVM/Pointer/AndersenOTFAATest.cpp
@@ -25,13 +25,14 @@
 #include <map>
 #include <memory>
 #include <source_location>
+#include <string>
 #include <vector>
 
 namespace {
 using namespace psr;
 using namespace psr::unittest;
 
-static_assert(UnionFindAAResult<AndersenOTFResult>);
+static_assert(RawAAResult<AndersenOTFResult>);
 
 constexpr auto PathToLLFiles = PHASAR_BUILD_SUBFOLDER("pointers/");
 
@@ -124,7 +125,7 @@ constexpr llvm::StringRef EntryNames[] = {"main"};
 /// the domain and are not subject to the precision check.
 void doAnalysisAndCheckExact(
     const llvm::Twine &IRFile, const GTMap &ExpectedResults,
-    bool DumpResults = false,
+    ContextSensitivityOptions CSOpts = {}, bool DumpResults = false,
     std::source_location Loc = std::source_location::current()) {
 
   auto IRDB = LLVMProjectIRDB::loadOrExit(PathToLLFiles + IRFile);
@@ -141,7 +142,8 @@ void doAnalysisAndCheckExact(
   }
 
   ValueCompressor<PAGVariable> Compressor;
-  AndersenOTFResult Results = computeAndersenOTFRaw(IRDB, Entries, &Compressor);
+  AndersenOTFResult Results = computeAndersenOTFRaw(
+      IRDB, Entries, &Compressor, Soundness::Soundy, std::move(CSOpts));
 
   // Build domain from all values explicitly named in the GT.
   llvm::SmallDenseSet<ValueId, 16> Domain;
@@ -187,10 +189,28 @@ void doAnalysisAndCheckExact(
   }
 
   if (DumpResults || ::testing::Test::HasFailure()) {
+    IRDB.emitPreprocessedIR(llvm::errs() << "LLVM IR:\n");
+    llvm::errs() << " ================== \n";
     dumpAnalysisState(Compressor, Results);
   }
 }
 
+using CSMode = ContextSensitivityOptions::Mode;
+
+ContextSensitivityOptions csOpts(CSMode Mode,
+                                 std::vector<std::string> Allow = {},
+                                 std::vector<std::string> Deny = {},
+                                 size_t Budget = 200000,
+                                 unsigned MaxContextsPerFunction = 8) {
+  ContextSensitivityOptions Opts;
+  Opts.SelectionMode = Mode;
+  Opts.AllowList = std::move(Allow);
+  Opts.DenyList = std::move(Deny);
+  Opts.MaxContextualNodes = Budget;
+  Opts.MaxContextsPerFunction = MaxContextsPerFunction;
+  return Opts;
+}
+
 // ---- Tests ----------------------------------------------------------------
 
 TEST(AndersenOTFAATest, InterProcArgRetAlias) {
@@ -265,6 +285,230 @@ TEST(AndersenOTFAATest, ContextInsensitiveCallsMerge) {
   doAnalysisAndCheckExact("context_01_c_dbg.ll", ExpectedResults);
 }
 
+TEST(AndersenOTFAATest, ContextSensitiveCallsStaySeparate) {
+  // Same fixture as ContextInsensitiveCallsMerge, with context-sensitivity on:
+  // each call site keeps its own clone of id's parameter/return nodes, so the
+  // two call results no longer alias each other.  The parameter and return
+  // slot themselves are the union over both contexts -- the external result
+  // has one id per PAGVariable, not one per context.
+  const TSL Arg = TSL(ArgInFun{.Idx = 0, .InFunction = "id"});
+  const TSL Ret = TSL(RetVal{.InFunction = "id"});
+  const TSL Call1 = TSL(LineColFunOp{.Line = 8,
+                                     .Col = 0,
+                                     .InFunction = "main",
+                                     .OpCode = llvm::Instruction::Call});
+  const TSL Call2 = TSL(LineColFunOp{.Line = 9,
+                                     .Col = 0,
+                                     .InFunction = "main",
+                                     .OpCode = llvm::Instruction::Call});
+  const GTMap ExpectedResults = {
+      {Arg, {Arg, Ret, Call1, Call2}},
+      {Ret, {Arg, Ret, Call1, Call2}},
+      {Call1, {Arg, Ret, Call1}},
+      {Call2, {Arg, Ret, Call2}},
+  };
+  doAnalysisAndCheckExact("context_01_c_dbg.ll", ExpectedResults,
+                          csOpts(CSMode::All));
+}
+
+TEST(AndersenOTFAATest, ReturnedParamSelectsDynamically) {
+  // context_01: id(p) returns p.  Only one pointer parameter and no indirect
+  // call, so id qualifies purely through "a param-derived value escapes via
+  // the return" -- the signal that generalizes beyond the end(p, q) shape.
+  const TSL Arg = TSL(ArgInFun{.Idx = 0, .InFunction = "id"});
+  const TSL Ret = TSL(RetVal{.InFunction = "id"});
+  const TSL Call1 = TSL(LineColFunOp{.Line = 8,
+                                     .Col = 0,
+                                     .InFunction = "main",
+                                     .OpCode = llvm::Instruction::Call});
+  const TSL Call2 = TSL(LineColFunOp{.Line = 9,
+                                     .Col = 0,
+                                     .InFunction = "main",
+                                     .OpCode = llvm::Instruction::Call});
+  const GTMap ExpectedResults = {
+      {Call1, {Arg, Ret, Call1}},
+      {Call2, {Arg, Ret, Call2}},
+  };
+  doAnalysisAndCheckExact("context_01_c_dbg.ll", ExpectedResults,
+                          csOpts(CSMode::Dynamic));
+}
+
+TEST(AndersenOTFAATest, ContextBudgetZeroMatchesInsensitive) {
+  // A budget of zero admits no function, so Mode::All degrades gracefully to
+  // exactly the context-insensitive result.
+  const TSL Arg = TSL(ArgInFun{.Idx = 0, .InFunction = "id"});
+  const TSL Ret = TSL(RetVal{.InFunction = "id"});
+  const TSL Call1 = TSL(LineColFunOp{.Line = 8,
+                                     .Col = 0,
+                                     .InFunction = "main",
+                                     .OpCode = llvm::Instruction::Call});
+  const TSL Call2 = TSL(LineColFunOp{.Line = 9,
+                                     .Col = 0,
+                                     .InFunction = "main",
+                                     .OpCode = llvm::Instruction::Call});
+  const GTMap ExpectedResults = {
+      {Arg, {Arg, Ret, Call1, Call2}},
+      {Ret, {Arg, Ret, Call1, Call2}},
+      {Call1, {Arg, Ret, Call1, Call2}},
+      {Call2, {Arg, Ret, Call1, Call2}},
+  };
+  doAnalysisAndCheckExact("context_01_c_dbg.ll", ExpectedResults,
+                          csOpts(CSMode::All, {}, {}, /*Budget=*/0));
+}
+
+TEST(AndersenOTFAATest, ContextBudgetDoesNotOverrideAllowList) {
+  // The budget also gates calleeContext, but an allow-listed function must
+  // still get its clones -- selected-but-uncloned is selected in name only.
+  const TSL Arg = TSL(ArgInFun{.Idx = 0, .InFunction = "id"});
+  const TSL Call1 = TSL(LineColFunOp{.Line = 8,
+                                     .Col = 0,
+                                     .InFunction = "main",
+                                     .OpCode = llvm::Instruction::Call});
+  const TSL Call2 = TSL(LineColFunOp{.Line = 9,
+                                     .Col = 0,
+                                     .InFunction = "main",
+                                     .OpCode = llvm::Instruction::Call});
+  const GTMap Expected = {{Call1, {Arg, Call1}}, {Call2, {Arg, Call2}}};
+  doAnalysisAndCheckExact("context_01_c_dbg.ll", Expected,
+                          csOpts(CSMode::Manual, {"id"}, {}, /*Budget=*/0));
+}
+
+TEST(AndersenOTFAATest, ContextManualAllowListSelectsOneFunction) {
+  // Only 'id' is allow-listed, so it gets per-call-site clones.
+  const TSL Arg = TSL(ArgInFun{.Idx = 0, .InFunction = "id"});
+  const TSL Call1 = TSL(LineColFunOp{.Line = 8,
+                                     .Col = 0,
+                                     .InFunction = "main",
+                                     .OpCode = llvm::Instruction::Call});
+  const TSL Call2 = TSL(LineColFunOp{.Line = 9,
+                                     .Col = 0,
+                                     .InFunction = "main",
+                                     .OpCode = llvm::Instruction::Call});
+  const GTMap Expected = {{Call1, {Arg, Call1}}, {Call2, {Arg, Call2}}};
+  doAnalysisAndCheckExact("context_01_c_dbg.ll", Expected,
+                          csOpts(CSMode::Manual, {"id"}));
+}
+
+TEST(AndersenOTFAATest, ContextDenyListOverridesAllowList) {
+  // 'id' is on both lists; deny wins, so the result stays insensitive.
+  const TSL Arg = TSL(ArgInFun{.Idx = 0, .InFunction = "id"});
+  const TSL Call1 = TSL(LineColFunOp{.Line = 8,
+                                     .Col = 0,
+                                     .InFunction = "main",
+                                     .OpCode = llvm::Instruction::Call});
+  const TSL Call2 = TSL(LineColFunOp{.Line = 9,
+                                     .Col = 0,
+                                     .InFunction = "main",
+                                     .OpCode = llvm::Instruction::Call});
+  const GTMap Expected = {{Call1, {Arg, Call1, Call2}},
+                          {Call2, {Arg, Call1, Call2}}};
+  doAnalysisAndCheckExact("context_01_c_dbg.ll", Expected,
+                          csOpts(CSMode::Manual, {"id"}, {"id"}));
+}
+
+TEST(AndersenOTFAATest, ContextInvalidGlobIsReported) {
+  // A malformed pattern is skipped with a diagnostic; 'id' still selects.
+  const TSL Arg = TSL(ArgInFun{.Idx = 0, .InFunction = "id"});
+  const TSL Call1 = TSL(LineColFunOp{.Line = 8,
+                                     .Col = 0,
+                                     .InFunction = "main",
+                                     .OpCode = llvm::Instruction::Call});
+  const TSL Call2 = TSL(LineColFunOp{.Line = 9,
+                                     .Col = 0,
+                                     .InFunction = "main",
+                                     .OpCode = llvm::Instruction::Call});
+  const GTMap Expected = {{Call1, {Arg, Call1}}, {Call2, {Arg, Call2}}};
+
+  testing::internal::CaptureStderr();
+  doAnalysisAndCheckExact("context_01_c_dbg.ll", Expected,
+                          csOpts(CSMode::Manual, {"[", "id"}));
+  const std::string Err = testing::internal::GetCapturedStderr();
+
+  EXPECT_NE(Err.find("Ignoring invalid allow-list pattern '['"),
+            std::string::npos)
+      << Err;
+}
+
+// context_15: end(&O1, &x) and end(&O2, &y); end dispatches through a
+// function-pointer field of its first parameter.
+static GTMap endPatternGT(bool Separate) {
+  const TSL XX = TSL(LineColFunOp{.Line = 22,
+                                  .Col = 0,
+                                  .InFunction = "main",
+                                  .OpCode = llvm::Instruction::Call});
+  const TSL YY = TSL(LineColFunOp{.Line = 23,
+                                  .Col = 0,
+                                  .InFunction = "main",
+                                  .OpCode = llvm::Instruction::Call});
+  if (Separate) {
+    return {{XX, {XX}}, {YY, {YY}}};
+  }
+  return {{XX, {XX, YY}}, {YY, {XX, YY}}};
+}
+
+TEST(AndersenOTFAATest, EndPatternMergesWithoutContexts) {
+  // Baseline: both call results alias, because end's formals are shared.
+  doAnalysisAndCheckExact("context_15_c_dbg.ll", endPatternGT(false));
+}
+
+TEST(AndersenOTFAATest, EndPatternSeparatedByDynamicSelection) {
+  // The dispatch inside end resolves to two targets, which promotes end (and
+  // its two targets) mid-solve; afterwards the call results stay separate.
+  doAnalysisAndCheckExact("context_15_c_dbg.ll", endPatternGT(true),
+                          csOpts(CSMode::Dynamic));
+}
+
+TEST(AndersenOTFAATest, EndPatternSeparatedByAllMode) {
+  doAnalysisAndCheckExact("context_15_c_dbg.ll", endPatternGT(true),
+                          csOpts(CSMode::All));
+}
+
+TEST(AndersenOTFAATest, MutualRecursionTerminatesWithContexts) {
+  // context_17: ping/pong recurse into each other from two call sites.  The
+  // k = 1 call string is bounded, so the solver must still converge -- and
+  // must not lose the sound arg/ret alias inside the recursion.
+  const TSL PingArg = TSL(ArgInFun{.Idx = 0, .InFunction = "ping"});
+  const TSL PingRet = TSL(RetVal{.InFunction = "ping"});
+  const GTMap Expected = {{PingRet, {PingArg, PingRet}}};
+  doAnalysisAndCheckExact("context_17_c_dbg.ll", Expected, csOpts(CSMode::All));
+}
+
+TEST(AndersenOTFAATest, SharedTableHelperNoCrossContextContamination) {
+  // context_16: make() allocates and fills a dispatch table, called from two
+  // sites with different callees.  With context cloning, each call site's
+  // table is its own object with its own FnPtrFieldWrites entry.
+  auto IRDB =
+      LLVMProjectIRDB::loadOrExit(PathToLLFiles + "context_16_c_dbg.ll");
+  const auto *MainFn = IRDB.getFunctionDefinition("main");
+  const auto *Red = IRDB.getFunctionDefinition("red");
+  const auto *Blue = IRDB.getFunctionDefinition("blue");
+  ASSERT_NE(MainFn, nullptr);
+  ASSERT_NE(Red, nullptr);
+  ASSERT_NE(Blue, nullptr);
+
+  llvm::SmallVector<const llvm::CallBase *, 2> IndirectCalls;
+  for (const auto &Inst : llvm::instructions(MainFn)) {
+    const auto *CallSite = llvm::dyn_cast<llvm::CallBase>(&Inst);
+    if (CallSite && !CallSite->isDebugOrPseudoInst() &&
+        !llvm::isa<llvm::Function>(
+            CallSite->getCalledOperand()->stripPointerCastsAndAliases())) {
+      IndirectCalls.push_back(CallSite);
+    }
+  }
+  ASSERT_EQ(IndirectCalls.size(), 2U);
+
+  auto Res = computeAndersenOTFRaw(IRDB, {MainFn}, nullptr, Soundness::Soundy,
+                                   csOpts(CSMode::All));
+
+  const auto &CalleesA = Res.CG.getCalleesOfCallAt(IndirectCalls[0]);
+  EXPECT_TRUE(llvm::is_contained(CalleesA, Red));
+  EXPECT_FALSE(llvm::is_contained(CalleesA, Blue));
+
+  const auto &CalleesB = Res.CG.getCalleesOfCallAt(IndirectCalls[1]);
+  EXPECT_TRUE(llvm::is_contained(CalleesB, Blue));
+  EXPECT_FALSE(llvm::is_contained(CalleesB, Red));
+}
+
 TEST(AndersenOTFAATest, SeparateFunctionsDontAlias) {
   // context_02: id1 and id2 are independent identity functions called with
   // different arguments.  Their parameter and return-value nodes must not
@@ -904,6 +1148,46 @@ TEST(AndersenOTFAATest, TwoArgSecondRetFourCallSites) {
   doAnalysisAndCheckExact("context_12_0_c_dbg.ll", ExpectedResults);
 }
 
+TEST(AndersenOTFAATest, MergingFormalsAloneSelectsDynamically) {
+  // Same fixture, context-sensitive.  argretq has no indirect call at all, so
+  // it qualifies only through "several call sites + several pointer
+  // parameters". Each call site now returns exactly its own second argument.
+  const auto MkCall = [](uint32_t Line) {
+    return TSL(LineColFunOp{.Line = Line,
+                            .Col = 0,
+                            .InFunction = "main",
+                            .OpCode = llvm::Instruction::Call});
+  };
+  // Lines 8/9 pass &x as the returned argument, lines 10/11 pass &y.
+  const GTMap ExpectedResults = {
+      {MkCall(8), {MkCall(8), MkCall(9)}},
+      {MkCall(9), {MkCall(8), MkCall(9)}},
+      {MkCall(10), {MkCall(10), MkCall(11)}},
+      {MkCall(11), {MkCall(10), MkCall(11)}},
+  };
+  doAnalysisAndCheckExact("context_12_0_c_dbg.ll", ExpectedResults,
+                          csOpts(CSMode::Dynamic));
+}
+
+TEST(AndersenOTFAATest, PerFunctionContextCapDegradesGracefully) {
+  // Same fixture with room for only two of argretq's four call sites.  The
+  // first two keep their own contexts; the rest fall back to the shared root
+  // context and merge, exactly as the context-insensitive solver would.
+  const auto MkCall = [](uint32_t Line) {
+    return TSL(LineColFunOp{.Line = Line,
+                            .Col = 0,
+                            .InFunction = "main",
+                            .OpCode = llvm::Instruction::Call});
+  };
+  const GTMap ExpectedResults = {
+      {MkCall(10), {MkCall(10), MkCall(11)}},
+      {MkCall(11), {MkCall(10), MkCall(11)}},
+  };
+  doAnalysisAndCheckExact("context_12_0_c_dbg.ll", ExpectedResults,
+                          csOpts(CSMode::Dynamic, {}, {}, /*Budget=*/200000,
+                                 /*MaxContextsPerFunction=*/2));
+}
+
 TEST(AndersenOTFAATest, VTableDispatch) {
   // Virtual call via A* in call_get must resolve through the vtable.
   // A::get() returns @x, so call_get's return must alias @x.
@@ -1332,6 +1616,257 @@ TEST(AndersenOTFAATest, FnPtrTableMemcpyPropagatesKnownFields) {
   EXPECT_FALSE(llvm::is_contained(BarCallees, FooImpl));
 }
 
+// ---- Regression tests for previously fixed defects ------------------------
+
+TEST(AndersenOTFAATest, PoisonSurvivesSCCCollapse) {
+  // pong's disqualifying store (`o->Fn = f`, f not a literal) lands on a node
+  // that LCD later folds into the ping/pong SCC. The re-check must resolve it
+  // through rep(), or O stays unpoisoned and call_fn is wrongly precise.
+  auto IRDB = LLVMProjectIRDB::loadOrExit(
+      PathToLLFiles + "andersen_otf_poison_scc_c_m2r_dbg.ll");
+  const auto *CallFn = IRDB.getFunctionDefinition("call_fn");
+  const auto *RealFn = IRDB.getFunctionDefinition("real_fn");
+  const auto *OtherFn = IRDB.getFunctionDefinition("other_fn");
+  const auto *MainFn = IRDB.getFunctionDefinition("main");
+  ASSERT_NE(MainFn, nullptr);
+  ASSERT_NE(CallFn, nullptr);
+  ASSERT_NE(RealFn, nullptr);
+  ASSERT_NE(OtherFn, nullptr);
+
+  auto Res = computeAndersenOTFRaw(IRDB, {MainFn});
+
+  const auto *CS = findFirstIndirectCall(CallFn);
+  ASSERT_NE(CS, nullptr);
+
+  const auto &Callees = Res.CG.getCalleesOfCallAt(CS);
+  EXPECT_TRUE(llvm::is_contained(Callees, RealFn));
+  EXPECT_TRUE(llvm::is_contained(Callees, OtherFn))
+      << "pong's non-literal field write must poison O even after its "
+         "pointer node collapses into the ping/pong SCC";
+}
+
+TEST(AndersenOTFAATest, LoopCarriedGEPKeepsBaseAliases) {
+  // handlePhi interns the loop-carried GEP before the GEP itself is
+  // translated, so addPtrAlias's addAlias() no-ops. The GEP must still end up
+  // aliasing Buf rather than keeping an empty pts-set.
+  const TSL Buf =
+      TSL(OperandOf{.OperandIndex = 0,
+                    .Inst = LineColFunOp{.Line = 15,
+                                         .Col = 0,
+                                         .InFunction = "main",
+                                         .OpCode = llvm::Instruction::Call}});
+  const TSL Gep = TSL(LineColFunOp{.Line = 8,
+                                   .Col = 0,
+                                   .InFunction = "findEnd",
+                                   .OpCode = llvm::Instruction::GetElementPtr});
+  const TSL Arg = TSL(ArgInFun{.Idx = 0, .InFunction = "findEnd"});
+  const std::vector<TSL> All = {Buf, Gep, Arg};
+  const GTMap Expected = {{Gep, All}, {Arg, All}, {Buf, All}};
+  doAnalysisAndCheckExact("andersen_otf_loop_gep_c_m2r_dbg.ll", Expected);
+}
+
+TEST(AndersenOTFAATest, MergeDoesNotStrandPendingPts) {
+  // handlePhi interns the loop-carried GEP first, so its still-empty node wins
+  // the join when the GEP is merged with the load it is based on. The absorbed
+  // diff must still cross GEP -> %P.0 instead of stranding in PendingPts.
+  auto IRDB = LLVMProjectIRDB::loadOrExit(
+      PathToLLFiles + "andersen_otf_stranded_pending_c_m2r_dbg.ll");
+  const auto *MainFn = IRDB.getFunctionDefinition("main");
+  const auto *WalkFn = IRDB.getFunctionDefinition("walk");
+  ASSERT_NE(MainFn, nullptr);
+  ASSERT_NE(WalkFn, nullptr);
+
+  const llvm::AllocaInst *Local = nullptr;
+  for (const auto &Inst : llvm::instructions(MainFn)) {
+    if (const auto *A = llvm::dyn_cast<llvm::AllocaInst>(&Inst);
+        A && A->getName() == "Local") {
+      Local = A;
+      break;
+    }
+  }
+  const llvm::PHINode *P = nullptr;
+  for (const auto &Inst : llvm::instructions(WalkFn)) {
+    if (const auto *N = llvm::dyn_cast<llvm::PHINode>(&Inst);
+        N && N->getType()->isPointerTy()) {
+      P = N;
+      break;
+    }
+  }
+  ASSERT_NE(Local, nullptr);
+  ASSERT_NE(P, nullptr);
+
+  ValueCompressor<PAGVariable> Compressor;
+  auto Res = computeAndersenOTFRaw(IRDB, {MainFn}, &Compressor);
+
+  const auto PId = Compressor.getOrNull(PAGVariable(P));
+  const auto LocalId = Compressor.getOrNull(PAGVariable(Local));
+  ASSERT_TRUE(PId.has_value());
+  ASSERT_TRUE(LocalId.has_value());
+  EXPECT_TRUE(Res.getRawAliasSet(*PId).contains(*LocalId))
+      << "P is assigned Base + 1 each round, so it must alias whatever "
+         "*Slot points to";
+}
+
+TEST(AndersenOTFAATest, AggregateReturnReachesCaller) {
+  // make() returns { ptr, i64 }, so the call result is not pointer-typed and
+  // reaches the caller only through an ExtractValueInst.
+  const TSL A =
+      TSL(OperandOf{.OperandIndex = 0,
+                    .Inst = LineColFunOp{.Line = 18,
+                                         .Col = 0,
+                                         .InFunction = "main",
+                                         .OpCode = llvm::Instruction::Call}});
+  const TSL BVal = TSL(LineColFunOp{.Line = 19,
+                                    .Col = 0,
+                                    .InFunction = "main",
+                                    .OpCode = llvm::Instruction::Load});
+  const std::vector<TSL> All = {A, BVal};
+  const GTMap Expected = {{A, All}, {BVal, All}};
+  doAnalysisAndCheckExact("andersen_otf_aggregate_ret_c_dbg.ll", Expected);
+}
+
+TEST(AndersenOTFAATest, AtomicExchangeIsAStoreAndALoad) {
+  // Clang lowers the pointer exchange to `atomicrmw xchg ptr %P, i64 ...`.
+  // Flow-insensitively P holds both A and B, so the exchanged-out value and
+  // the reloaded one each alias both.
+  const TSL A =
+      TSL(OperandOf{.OperandIndex = 0,
+                    .Inst = LineColFunOp{.Line = 6,
+                                         .Col = 0,
+                                         .InFunction = "main",
+                                         .OpCode = llvm::Instruction::Store}});
+  const TSL B =
+      TSL(OperandOf{.OperandIndex = 0,
+                    .Inst = LineColFunOp{.Line = 7,
+                                         .Col = 0,
+                                         .InFunction = "main",
+                                         .OpCode = llvm::Instruction::Store}});
+  const TSL OldVal = TSL(LineColFunOp{.Line = 10,
+                                      .Col = 0,
+                                      .InFunction = "main",
+                                      .OpCode = llvm::Instruction::Load});
+  const TSL CurVal = TSL(LineColFunOp{.Line = 11,
+                                      .Col = 0,
+                                      .InFunction = "main",
+                                      .OpCode = llvm::Instruction::Load});
+  const GTMap Expected = {
+      {A, {A, OldVal, CurVal}},
+      {B, {B, OldVal, CurVal}},
+      {OldVal, {A, B, OldVal, CurVal}},
+      {CurVal, {A, B, OldVal, CurVal}},
+  };
+  doAnalysisAndCheckExact("andersen_otf_atomics_c_dbg.ll", Expected);
+}
+
+TEST(AndersenOTFAATest, MemSSAConstExprDefAssignsLeaves) {
+  // The load's single reaching def stores a ConstantExpr GEP of A. That value
+  // cannot be aliased with, but its leaves still are, so the load must not
+  // pick up the B that the earlier indirect store also put into P.
+  const TSL Load = TSL(LineColFunOp{.Line = 13,
+                                    .Col = 0,
+                                    .InFunction = "main",
+                                    .OpCode = llvm::Instruction::Load});
+  const TSL A = TSL(GlobalVar{.Name = "A"});
+  const TSL B = TSL(GlobalVar{.Name = "B"});
+  const GTMap Expected = {
+      {Load, {Load, A}},
+      {A, {A, Load}},
+      {B, {B}},
+  };
+  doAnalysisAndCheckExact("memssa_constexpr_def_c_dbg.ll", Expected);
+}
+
+TEST(AndersenOTFAATest, ContextsDoNotComposeAtK1) {
+  // context_04_1: id3 -> id2 -> id1, called four times from main.  k = 1 makes
+  // withPrefix drop the caller string, so all four id3 clones feed the single
+  // id2@{CS} clone and the results re-merge one level down.  Pins that; a
+  // future k > 1 must break it.
+  const TSL XX1 = TSL(LineColFunOp{.Line = 10,
+                                   .Col = 0,
+                                   .InFunction = "main",
+                                   .OpCode = llvm::Instruction::Call});
+  const TSL XX2 = TSL(LineColFunOp{.Line = 11,
+                                   .Col = 0,
+                                   .InFunction = "main",
+                                   .OpCode = llvm::Instruction::Call});
+  const TSL YY1 = TSL(LineColFunOp{.Line = 12,
+                                   .Col = 0,
+                                   .InFunction = "main",
+                                   .OpCode = llvm::Instruction::Call});
+  const TSL YY2 = TSL(LineColFunOp{.Line = 13,
+                                   .Col = 0,
+                                   .InFunction = "main",
+                                   .OpCode = llvm::Instruction::Call});
+  const TSL XAlloca =
+      TSL(OperandOf{.OperandIndex = 0,
+                    .Inst = LineColFunOp{.Line = 10,
+                                         .Col = 0,
+                                         .InFunction = "main",
+                                         .OpCode = llvm::Instruction::Call}});
+  const TSL YAlloca =
+      TSL(OperandOf{.OperandIndex = 0,
+                    .Inst = LineColFunOp{.Line = 12,
+                                         .Col = 0,
+                                         .InFunction = "main",
+                                         .OpCode = llvm::Instruction::Call}});
+  const std::vector<TSL> AllRets = {XX1, XX2, YY1, YY2};
+  std::vector<TSL> WithX = AllRets;
+  WithX.push_back(XAlloca);
+  std::vector<TSL> WithY = AllRets;
+  WithY.push_back(YAlloca);
+  std::vector<TSL> Both = WithX;
+  Both.push_back(YAlloca);
+  const GTMap Expected = {
+      {XX1, Both}, {XX2, Both},      {YY1, Both},
+      {YY2, Both}, {XAlloca, WithX}, {YAlloca, WithY},
+  };
+  doAnalysisAndCheckExact("context_04_1_c_dbg.ll", Expected,
+                          csOpts(CSMode::All));
+}
+
+TEST(AndersenOTFAATest, PrePopulatedCompressorKeepsAllAliases) {
+  // A caller-supplied compressor that already maps both a GEP and its base
+  // pointer to distinct external ids must not leave either with an empty
+  // alias set, since they are the same PAG node.
+  auto IRDB = LLVMProjectIRDB::loadOrExit(
+      PathToLLFiles + "andersen_otf_fnptr_table_basic_c_dbg.ll");
+  const auto *MainFn = IRDB.getFunctionDefinition("main");
+  const auto *CallFoo = IRDB.getFunctionDefinition("call_foo");
+  ASSERT_NE(MainFn, nullptr);
+  ASSERT_NE(CallFoo, nullptr);
+
+  const llvm::GetElementPtrInst *Gep = nullptr;
+  for (const auto &Inst : llvm::instructions(CallFoo)) {
+    if (const auto *G = llvm::dyn_cast<llvm::GetElementPtrInst>(&Inst)) {
+      Gep = G;
+      break;
+    }
+  }
+  ASSERT_NE(Gep, nullptr);
+  const auto *Base = Gep->getPointerOperand();
+
+  // Pre-intern both ends of the aliasing pair, in the order the solver cannot
+  // reproduce: each gets its own external id.
+  ValueCompressor<PAGVariable> Compressor;
+  Compressor.insert(PAGVariable(Gep));
+  Compressor.insert(PAGVariable(Base));
+
+  auto Res = computeAndersenOTFRaw(IRDB, {MainFn}, &Compressor);
+
+  const auto GepId = Compressor.getOrNull(PAGVariable(Gep));
+  const auto BaseId = Compressor.getOrNull(PAGVariable(Base));
+  ASSERT_TRUE(GepId.has_value());
+  ASSERT_TRUE(BaseId.has_value());
+
+  const auto &GepAliases = Res.getRawAliasSet(*GepId);
+  const auto &BaseAliases = Res.getRawAliasSet(*BaseId);
+  EXPECT_FALSE(GepAliases.empty());
+  EXPECT_FALSE(BaseAliases.empty());
+  EXPECT_EQ(GepAliases, BaseAliases)
+      << "the GEP and its base are one PAG node, so a caller-supplied "
+         "compressor must not lose either one's alias set";
+}
+
 } // namespace
 
 int main(int Argc, char **Argv) {
diff --git a/unittests/PhasarLLVM/Pointer/LLVMUnionFindAATest.cpp b/unittests/PhasarLLVM/Pointer/LLVMUnionFindAATest.cpp
index b452d5b36f..8598d6e2f9 100644
--- a/unittests/PhasarLLVM/Pointer/LLVMUnionFindAATest.cpp
+++ b/unittests/PhasarLLVM/Pointer/LLVMUnionFindAATest.cpp
@@ -25,7 +25,10 @@
 #include "gtest/gtest.h"
 
 #include <map>
+#include <set>
 #include <source_location>
+#include <string>
+#include <tuple>
 #include <vector>
 
 namespace {
@@ -91,7 +94,7 @@ void doAnalysisAndCompareResults(
                                         {"main"}, TH, VTP);
 
   ValueCompressor<PAGVariable> VC;
-  UnionFindAAResult auto Results = computeUnionFindAARaw(
+  RawAAResult auto Results = computeUnionFindAARaw(
       IRDB, AABuilder(IRDB, BaseCG), &VC, std::move(Impl));
 
   for (const auto &[PtrVar, ExpectedAliasVars] : ExpectedResults) {
@@ -7317,6 +7320,109 @@ TEST(IndirectionSensUnionFindAATest, Indirection10) {
   doAnalysisAndCompareResults("indirection_10_cpp_dbg.ll", GT, IndAABuilder);
 }
 
+// ---------------------------------------------------------------------------
+// Pointer-punning tests
+//
+// P is overwritten and re-read through an intptr_t view of its slot, so both
+// accesses are typed i64.  The plain integer-type gate used to drop them,
+// leaving the loaded pointer unaliased.
+// ---------------------------------------------------------------------------
+
+static const GTMap PunningGT = {
+    // The punned load: reads what either store put into P.
+    {LineColFunOp{.Line = 12,
+                  .Col = 0,
+                  .InFunction = "main",
+                  .OpCode = llvm::Instruction::Load},
+     {GlobalVar{"A"}, GlobalVar{"B"}}},
+    // ... and so does Q, which it is stored into.
+    {LineColFunOp{.Line = 13,
+                  .Col = 0,
+                  .InFunction = "main",
+                  .OpCode = llvm::Instruction::Load},
+     {GlobalVar{"A"}, GlobalVar{"B"}}},
+};
+
+TEST(CtxSensUnionFindAATest, PointerPunning01) {
+  doAnalysisAndCompareResults("pointer_punning_01_c_dbg.ll", PunningGT,
+                              ContextAABuilder);
+}
+
+TEST(IndirectionSensUnionFindAATest, PointerPunning01) {
+  doAnalysisAndCompareResults("pointer_punning_01_c_dbg.ll", PunningGT,
+                              IndAABuilder);
+}
+
+TEST(BotUnionFindAATest, PointerPunning01) {
+  doAnalysisAndCompareResults("pointer_punning_01_c_dbg.ll", PunningGT,
+                              BotAABuilder);
+}
+
+// ---------------------------------------------------------------------------
+// Atomic read-modify-write tests
+//
+// Clang lowers the pointer exchange to `atomicrmw xchg ptr %P, i64 ...`.
+// Flow-insensitively P holds both A and B, so the exchanged-out value and the
+// reloaded one each alias both.  Without the atomicrmw case in dispatch, none
+// of these are related at all.
+//
+// AndersenOTFAATest keeps A and B apart here; a union-find cannot, since both
+// reach the same loads and a single equivalence class is all it can express.
+// ---------------------------------------------------------------------------
+
+static const TestingSrcLocation AtomicsA =
+    OperandOf{.OperandIndex = 0,
+              .Inst = LineColFunOp{.Line = 6,
+                                   .Col = 0,
+                                   .InFunction = "main",
+                                   .OpCode = llvm::Instruction::Store}};
+static const TestingSrcLocation AtomicsB =
+    OperandOf{.OperandIndex = 0,
+              .Inst = LineColFunOp{.Line = 7,
+                                   .Col = 0,
+                                   .InFunction = "main",
+                                   .OpCode = llvm::Instruction::Store}};
+static const TestingSrcLocation AtomicsExchanged =
+    LineColFunOp{.Line = 8,
+                 .Col = 0,
+                 .InFunction = "main",
+                 .OpCode = llvm::Instruction::AtomicRMW};
+static const TestingSrcLocation AtomicsOldVal =
+    LineColFunOp{.Line = 10,
+                 .Col = 0,
+                 .InFunction = "main",
+                 .OpCode = llvm::Instruction::Load};
+static const TestingSrcLocation AtomicsCurVal =
+    LineColFunOp{.Line = 11,
+                 .Col = 0,
+                 .InFunction = "main",
+                 .OpCode = llvm::Instruction::Load};
+
+static const std::vector<TestingSrcLocation> AtomicsAll = {
+    AtomicsA, AtomicsB, AtomicsExchanged, AtomicsOldVal, AtomicsCurVal};
+
+static const GTMap AtomicsGT = {
+    {AtomicsA, AtomicsAll},
+    {AtomicsB, AtomicsAll},
+    {AtomicsOldVal, AtomicsAll},
+    {AtomicsCurVal, AtomicsAll},
+};
+
+TEST(CtxSensUnionFindAATest, AtomicExchange) {
+  doAnalysisAndCompareResults("andersen_otf_atomics_c_dbg.ll", AtomicsGT,
+                              ContextAABuilder);
+}
+
+TEST(IndirectionSensUnionFindAATest, AtomicExchange) {
+  doAnalysisAndCompareResults("andersen_otf_atomics_c_dbg.ll", AtomicsGT,
+                              IndAABuilder);
+}
+
+TEST(BotUnionFindAATest, AtomicExchange) {
+  doAnalysisAndCompareResults("andersen_otf_atomics_c_dbg.ll", AtomicsGT,
+                              BotAABuilder);
+}
+
 // ---------------------------------------------------------------------------
 // MemorySSA flow-sensitivity tests
 //
@@ -7339,6 +7445,30 @@ TEST(MemSSAUnionFindAATest, KillStore) {
                               LLVMPAGBuilder::withBuiltinMemSSA());
 }
 
+// The loop-carried load is interned by the PHI before handleLoad translates
+// it, so addAlias() no-ops. On the single-reaching-def MemSSA path that used
+// to leave the load with no incoming edge at all, losing the alias to A.
+TEST(MemSSAUnionFindAATest, LoopCarriedLoad) {
+  // The loop pointer P, i.e. the PHI the load feeds.
+  const TestingSrcLocation Phi =
+      OperandOf{.OperandIndex = 0,
+                .Inst = LineColFunOp{.Line = 15,
+                                     .Col = 0,
+                                     .InFunction = "main",
+                                     .OpCode = llvm::Instruction::Load}};
+  // Slot joins A through addDelayedEdges' store-safety fallback.
+  GTMap GT = {{LineColFunOp{.Line = 13,
+                            .Col = 0,
+                            .InFunction = "main",
+                            .OpCode = llvm::Instruction::Load},
+               {GlobalVar{"A"}, GlobalVar{"B"}, GlobalVar{"Slot"}, Phi}},
+              {Phi, {GlobalVar{"A"}, GlobalVar{"B"}, GlobalVar{"Slot"}, Phi}}};
+
+  doAnalysisAndCompareResults("loop_carried_load_c_m2r_dbg.ll", GT,
+                              ContextAABuilder,
+                              LLVMPAGBuilder::withBuiltinMemSSA());
+}
+
 // if (c) p = &a; else p = &b; q = load p  — MemoryPhi: q aliases both a and b
 TEST(MemSSAUnionFindAATest, BranchBothReach) {
   GTMap GT = {{LineColFunOp{.Line = 9,
@@ -7358,6 +7488,80 @@ TEST(MemSSAUnionFindAATest, BranchBothReach) {
                               LLVMPAGBuilder::withBuiltinMemSSA());
 }
 
+/// Maps every value name to the names in its alias set, so that two runs can
+/// be compared without depending on the ValueIds they happen to assign.
+[[nodiscard]] std::map<std::string, std::set<std::string>>
+collectAliasSetsByName(const ValueCompressor<PAGVariable> &VC,
+                       const RawAAResult auto &Results) {
+  std::map<std::string, std::set<std::string>> Ret;
+
+  for (const auto &[VId, Vars] : VC.id2vars().enumerate()) {
+    std::set<std::string> Aliases;
+    Results.getRawAliasSet(VId).foreach ([&](ValueId AId) {
+      for (const auto Alias : VC.id2vars(AId)) {
+        Aliases.insert(to_string(Alias));
+      }
+    });
+
+    for (const auto Var : Vars) {
+      Ret[to_string(Var)] = Aliases;
+    }
+  }
+
+  return Ret;
+}
+
+/// A pre-populated ValueCompressor shifts every ValueId. As the strategies
+/// index their per-value tables by id, seeding it must not change the result.
+void checkPrePopulatedVCMatches(
+    const llvm::Twine &IRFile, auto AABuilder,
+    std::source_location Loc = std::source_location::current()) {
+
+  auto IRDB = LLVMProjectIRDB::loadOrExit(PathToLLFiles + IRFile);
+  auto TH = DIBasedTypeHierarchy(IRDB);
+  auto VTP = LLVMVFTableProvider(IRDB);
+  auto BaseCG = buildLLVMBasedCallGraph(IRDB, CallGraphAnalysisType::RTA,
+                                        {"main"}, TH, VTP);
+
+  ValueCompressor<PAGVariable> PlainVC;
+  const auto Plain = collectAliasSetsByName(
+      PlainVC, computeUnionFindAARaw(IRDB, AABuilder(IRDB, BaseCG), &PlainVC));
+
+  // Seed the globals, so they no longer receive the ids buildPAG would assign.
+  ValueCompressor<PAGVariable> SeededVC;
+  for (const auto &Glob : IRDB.getModule()->globals()) {
+    std::ignore = SeededVC.insert(&Glob);
+  }
+  ASSERT_NE(0U, SeededVC.size()) << "Test needs a module with globals";
+
+  const auto Seeded = collectAliasSetsByName(
+      SeededVC,
+      computeUnionFindAARaw(IRDB, AABuilder(IRDB, BaseCG), &SeededVC));
+
+  for (const auto &[Var, Aliases] : Plain) {
+    const auto It = Seeded.find(Var);
+    if (It == Seeded.end()) {
+      ADD_FAILURE_AT(Loc.file_name(), Loc.line())
+          << "Value missing from the seeded run: " << Var;
+      continue;
+    }
+    EXPECT_EQ(Aliases, It->second) << "Alias set of " << Var << " differs at "
+                                   << Loc.file_name() << ':' << Loc.line();
+  }
+}
+
+TEST(CtxSensUnionFindAATest, PrePopulatedVC) {
+  checkPrePopulatedVCMatches("loop_carried_load_c_dbg.ll", ContextAABuilder);
+}
+
+TEST(IndirectionSensUnionFindAATest, PrePopulatedVC) {
+  checkPrePopulatedVCMatches("loop_carried_load_c_dbg.ll", IndAABuilder);
+}
+
+TEST(BotUnionFindAATest, PrePopulatedVC) {
+  checkPrePopulatedVCMatches("loop_carried_load_c_dbg.ll", BotAABuilder);
+}
+
 } // namespace
 
 int main(int Argc, char **Argv) {