I just read Logic-flow analysis of higher-order programs by Matt Might.
Great paper, and had a lot of the ideas that were spinning around in my mind. Matt Might has done a ton of work in so many areas of control flow analysis that it boggles my mind.
The related work section at the end includes many references that I'd like to read to understand more in this area. However, I feel like egglog supersedes this work, with a lot of the same ideas but in a better framework for extending and experimenting with the ideas.