@@ -0,0 +1,50 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\File;
+
+use PHPStan\DependencyInjection\AutowiredService;
+use function hash_file;
+use function stat;
+
+/**
+ * Memoizes SHA-256 content hashes per process for the lifetime of a run.
+ *
+ * PHPStan hashes the same file repeatedly — once per located identifier in
+ * OptimizedDirectorySourceLocator, once per PHPDoc cache check in
+ * FileTypeMapper, once per directory fingerprint in the source-locator
+ * factory. Project content is already treated as immutable for the duration
+ * of a run (the result cache and the odsl fingerprints rely on this), so a
+ * repeated hash of an unchanged file is pure waste. An mtime+size
+ * revalidation guards the memo against files regenerated mid-run at the
+ * cost of one stat() per repeated ask.
+ */
+#[AutowiredService]
+final class FileContentHasher
+{
+
+	/** @var array<string, array{int, int, string}> path => [mtime, size, sha256] */
+	private array $hashes = [];
+
+	public function hash(string $file): string|false
+	{
+		$stat = @stat($file);
+		if ($stat === false) {
+			return false;
+		}
+
+		$memo = $this->hashes[$file] ?? null;
+		if ($memo !== null && $memo[0] === $stat['mtime'] && $memo[1] === $stat['size']) {
+			return $memo[2];
+		}
+
+		$hash = hash_file('sha256', $file);
+		if ($hash === false) {
+			return false;
+		}
+
+		$this->hashes[$file] = [$stat['mtime'], $stat['size'], $hash];
+
+		return $hash;
+	}
+
+}
@@ -15,6 +15,7 @@
 use PHPStan\BetterReflection\SourceLocator\Ast\Strategy\NodeToReflection;
 use PHPStan\BetterReflection\SourceLocator\Type\SourceLocator;
 use PHPStan\Cache\ArenaCache;
+use PHPStan\File\FileContentHasher;
 use PHPStan\Cache\Cache;
 use PHPStan\File\CouldNotReadFileException;
 use PHPStan\Internal\ComposerHelper;
@@ -24,7 +25,6 @@
 use function array_key_exists;
 use function array_values;
 use function current;
-use function hash_file;
 use function is_array;
 use function is_string;
 use function sprintf;
@@ -58,6 +58,7 @@ public function __construct(
 		private FileNodesFetcher $fileNodesFetcher,
 		private Cache $cache,
 		private PhpVersion $phpVersion,
+		private FileContentHasher $fileContentHasher,
 		private array $classToFile,
 		private array $functionToFiles,
 		private array $constantToFile,
@@ -71,7 +72,7 @@ public function __construct(
 	 */
 	private function getCacheKeys(string $file, Identifier $identifier): array
 	{
-		$fileHash = hash_file('sha256', $file);
+		$fileHash = $this->fileContentHasher->hash($file);
 		if ($fileHash === false) {
 			throw new CouldNotReadFileException($file);
 		}
 
@@ -6,6 +6,7 @@
 use PHPStan\Cache\Cache;
 use PHPStan\DependencyInjection\AutowiredParameter;
 use PHPStan\DependencyInjection\AutowiredService;
+use PHPStan\File\FileContentHasher;
 use PHPStan\File\FileFinder;
 use PHPStan\Internal\DirectoryCreator;
 use PHPStan\Internal\DirectoryCreatorException;
@@ -15,8 +16,8 @@
 use function fclose;
 use function flock;
 use function fopen;
-use function hash_file;
 use function hrtime;
+use function is_array;
 use function ksort;
 use function serialize;
 use function sha1;
@@ -41,13 +42,22 @@ final class OptimizedDirectorySourceLocatorFactory
 
 	private const SCAN_LOCK_POLL_INTERVAL_MICROSECONDS = 50_000;
 
+	/**
+	 * The hash lock is polled much finer than the scan lock: every worker
+	 * reaches the same directories in near lockstep at startup, and most
+	 * directories hash in well under the scan lock's 50ms tick, so a coarse
+	 * poll would make lock losers sleep longer than the work they skip.
+	 */
+	private const HASH_LOCK_POLL_INTERVAL_MICROSECONDS = 5_000;
+
 	public function __construct(
 		private FileNodesFetcher $fileNodesFetcher,
 		#[AutowiredParameter(ref: '@fileFinderScan')]
 		private FileFinder $fileFinder,
 		private PhpVersion $phpVersion,
 		private SymbolFinderInFiles $symbolFinderInFiles,
 		private Cache $cache,
+		private FileContentHasher $fileContentHasher,
 		#[AutowiredParameter]
 		private string $tmpDir,
 	)
@@ -56,17 +66,63 @@ public function __construct(
 
 	public function createByDirectory(string $directory): OptimizedDirectorySourceLocator
 	{
-		$files = $this->fileFinder->findFiles([$directory])->getFiles();
-		$fileHashes = [];
-		foreach ($files as $file) {
-			$hash = hash_file('sha256', $file);
-			if ($hash === false) {
-				continue;
+		$cacheKey = sprintf('odsl-%s', $directory);
+		$hashesRecordKey = 'odsl-filehashes-' . $directory;
+
+		// The walk + hash of a directory is identical in every process of a
+		// run, and running it once per worker in parallel multiplies both the
+		// CPU and — on hosts where concurrent open() is expensive — the wall
+		// cost of the analysis startup. When the run has a shared arena, the
+		// first process publishes the file-hash map and everyone else reuses
+		// it. hasRecord() on the analysed-files record (published by the
+		// master before workers spawn) doubles as the "is an arena active?"
+		// probe — the seam has no explicit method for that and only grows one
+		// together with the extension.
+		$arenaActive = ArenaCache::hasRecord('analysed-files');
+		$hashesLock = null;
+		if ($arenaActive) {
+			$shared = ArenaCache::lookup($hashesRecordKey);
+			if (is_array($shared)) {
+				/** @var array<string, string> $shared */
+				return $this->createCachedDirectorySourceLocator($shared, $cacheKey);
+			}
+
+			// Single-flight the walk + hash, same pattern as the cold-cache
+			// scan below: the winner computes and publishes, losers wait and
+			// re-read the record. A lost lock (timeout, unwritable tmp) just
+			// means this worker hashes the directory itself.
+			$hashesLock = $this->acquireDirectoryScanLock('hashes-' . $directory, self::HASH_LOCK_POLL_INTERVAL_MICROSECONDS);
+			if ($hashesLock !== null) {
+				$shared = ArenaCache::lookup($hashesRecordKey);
+				if (is_array($shared)) {
+					$this->releaseDirectoryScanLock($hashesLock);
+
+					/** @var array<string, string> $shared */
+					return $this->createCachedDirectorySourceLocator($shared, $cacheKey);
+				}
+			}
+		}
+
+		try {
+			$files = $this->fileFinder->findFiles([$directory])->getFiles();
+			$fileHashes = [];
+			foreach ($files as $file) {
+				$hash = $this->fileContentHasher->hash($file);
+				if ($hash === false) {
+					continue;
+				}
+				$fileHashes[$file] = $hash;
+			}
+
+			if ($arenaActive) {
+				ArenaCache::publish($hashesRecordKey, $fileHashes);
+			}
+		} finally {
+			if ($hashesLock !== null) {
+				$this->releaseDirectoryScanLock($hashesLock);
 			}
-			$fileHashes[$file] = $hash;
 		}
 
-		$cacheKey = sprintf('odsl-%s', $directory);
 		return $this->createCachedDirectorySourceLocator($fileHashes, $cacheKey);
 	}
 
@@ -96,6 +152,7 @@ private function createCachedDirectorySourceLocator(array $fileHashes, string $c
 				$this->fileNodesFetcher,
 				$this->cache,
 				$this->phpVersion,
+				$this->fileContentHasher,
 				[],
 				[],
 				[],
@@ -188,6 +245,7 @@ private function createCachedDirectorySourceLocator(array $fileHashes, string $c
 			$this->fileNodesFetcher,
 			$this->cache,
 			$this->phpVersion,
+			$this->fileContentHasher,
 			$classToFile,
 			$functionToFiles,
 			$constantToFile,
@@ -202,7 +260,7 @@ private function createCachedDirectorySourceLocator(array $fileHashes, string $c
 	 *
 	 * @return resource|null
 	 */
-	private function acquireDirectoryScanLock(string $lockKey)
+	private function acquireDirectoryScanLock(string $lockKey, int $pollIntervalMicroseconds = self::SCAN_LOCK_POLL_INTERVAL_MICROSECONDS)
 	{
 		$lockDirectory = sprintf('%s/cache/locks', $this->tmpDir);
 		try {
@@ -231,7 +289,7 @@ private function acquireDirectoryScanLock(string $lockKey)
 				return null;
 			}
 
-			usleep(self::SCAN_LOCK_POLL_INTERVAL_MICROSECONDS);
+			usleep($pollIntervalMicroseconds);
 		}
 
 		return $lockHandle;
@@ -266,7 +324,7 @@ public function createByFiles(array $files, string $uniqueCacheIdentifier): Opti
 	{
 		$fileHashes = [];
 		foreach ($files as $file) {
-			$hash = hash_file('sha256', $file);
+			$hash = $this->fileContentHasher->hash($file);
 			if ($hash === false) {
 				continue;
 			}
 
@@ -12,6 +12,7 @@
 use PHPStan\Cache\Cache;
 use PHPStan\DependencyInjection\AutowiredParameter;
 use PHPStan\DependencyInjection\AutowiredService;
+use PHPStan\File\FileContentHasher;
 use PHPStan\File\FileHelper;
 use PHPStan\Internal\ComposerHelper;
 use PHPStan\Parser\Parser;
@@ -40,7 +41,6 @@
 use function array_pop;
 use function array_reverse;
 use function count;
-use function hash_file;
 use function in_array;
 use function is_array;
 use function is_file;
@@ -83,6 +83,7 @@ public function __construct(
 		private AnonymousClassNameHelper $anonymousClassNameHelper,
 		private FileHelper $fileHelper,
 		private Cache $cache,
+		private FileContentHasher $fileContentHasher,
 		#[AutowiredParameter(ref: '%cache.resolvedPhpDocBlockCacheCountMax%')]
 		private int $resolvedPhpDocBlockCacheCountMax,
 		#[AutowiredParameter(ref: '%cache.nameScopeMapMemoryCacheCountMax%')]
@@ -352,7 +353,7 @@ private function getNameScopeMap(string $fileName): array
 			[$nameScopeMap, $files] = $this->createPhpDocNodeMap($fileName, null, null, [], $fileName);
 			$filesWithHashes = [];
 			foreach ($files as $file) {
-				$newHash = hash_file('sha256', $file);
+				$newHash = $this->fileContentHasher->hash($file);
 				$filesWithHashes[$file] = $newHash;
 			}
 			$this->cache->save($cacheKey, $variableCacheKey, [$nameScopeMap, $filesWithHashes]);
@@ -388,7 +389,7 @@ private function loadCachedPhpDocNodeMap(string $cacheKey, string $variableCache
 			[$nameScopeMap, $filesWithHashes] = $cached;
 			$useCache = true;
 			foreach ($filesWithHashes as $file => $hash) {
-				$newHash = @hash_file('sha256', $file);
+				$newHash = $this->fileContentHasher->hash($file);
 				if ($newHash === false) {
 					$useCache = false;
 					break;