@@ -22,6 +22,7 @@
 use PHPStan\File\CouldNotWriteFileException;
 use PHPStan\File\FileFinder;
 use PHPStan\File\FileHelper;
+use PHPStan\File\FileStatSignatures;
 use PHPStan\Internal\ArrayHelper;
 use PHPStan\Internal\ComposerHelper;
 use PHPStan\Php\ComposerPhpVersionFactory;
@@ -81,7 +82,6 @@
 use function uniqid;
 use function unlink;
 use function unserialize;
-use const DIRECTORY_SEPARATOR;
 use const PHP_VERSION_ID;
 use const SEEK_CUR;
 
@@ -158,7 +158,7 @@ final class ResultCacheManager
 	 *
 	 * @var array<string, string>
 	 */
-	private array $fileStatSignatures = [];
+	private array $recordedFileStats = [];
 
 	private ?ResultCachePathTransformer $pathTransformer = null;
 
@@ -223,6 +223,7 @@ public function __construct(
 		private string $anchorDirectory,
 		private PhpVersion $phpVersion,
 		private ComposerPhpVersionFactory $composerPhpVersionFactory,
+		private FileStatSignatures $fileStatSignatures,
 	)
 	{
 	}
@@ -291,7 +292,7 @@ public function restore(array $allAnalysedFiles, bool $debug, bool $onlyFiles, ?
 	{
 		$this->restoredCacheUnchanged = false;
 		$this->restoredStubFiles = [];
-		$this->fileStatSignatures = [];
+		$this->recordedFileStats = [];
 
 		$startTime = microtime(true);
 		$analysedFileStats = $this->statAnalysedFiles($allAnalysedFiles);
@@ -2511,8 +2512,8 @@ private function createDependencyEntry(string $file, array $currentFileHashes):
 			'fileHash' => $currentFileHashes[$file] ?? $this->getDependencyFileHash($file),
 			'dependentFiles' => [],
 		];
-		if (array_key_exists($file, $currentFileHashes) && array_key_exists($file, $this->fileStatSignatures)) {
-			$entry['fileStat'] = $this->fileStatSignatures[$file];
+		if (array_key_exists($file, $currentFileHashes) && array_key_exists($file, $this->recordedFileStats)) {
+			$entry['fileStat'] = $this->recordedFileStats[$file];
 		}
 
 		return $entry;
@@ -2540,30 +2541,23 @@ private function statAnalysedFiles(array $allAnalysedFiles): array
 
 	/**
 	 * Hashing every analysed file is the bulk of what a run with nothing to re-analyse costs - on
-	 * Drupal core almost a second for 11k files. A file whose size, mtime, ctime, inode and device
-	 * are what they were when it was last hashed has not been written to since, so the hash the
-	 * cache recorded then is reused - the check git makes against its index. ctime cannot be set
-	 * back the way mtime can (touch, an extracted archive), and a replaced file has a new inode.
-	 *
-	 * A signature is only recorded for a file last modified before the second its hash was taken:
-	 * the timestamps have a one-second granularity, so a file written again within that same second
-	 * would keep a matching signature over different contents. On Windows the ctime PHP reports is
-	 * the creation time, which a file rewritten in place keeps, so nothing is reused there.
+	 * Drupal core almost a second for 11k files. A file whose stat signature is what it was when it
+	 * was last hashed has not been written to since, so the hash the cache recorded then is reused
+	 * - see FileStatSignatures.
 	 *
 	 * @param array<string, array<int|string, int>> $analysedFileStats
 	 * @param array<string, array{fileHash: string, fileStat?: string, dependentFiles: list<string>, usedTraitDependentFiles?: list<string>}>|null $cachedDependencies
 	 * @return array<string, string>
 	 */
 	private function hashAnalysedFiles(array $analysedFileStats, ?array $cachedDependencies): array
 	{
-		$now = time();
-		$trustSignatures = DIRECTORY_SEPARATOR === '/';
+		$signatures = $this->fileStatSignatures->begin();
 		$hashes = [];
 		foreach ($analysedFileStats as $file => $stat) {
-			$signature = sprintf('%d:%d:%d:%d:%d', $stat['size'], $stat['mtime'], $stat['ctime'], $stat['ino'], $stat['dev']);
+			$signature = $signatures->fromStat($stat);
 			$cachedEntry = $cachedDependencies[$file] ?? null;
 			if (
-				$trustSignatures
+				$signature !== null
 				&& $cachedEntry !== null
 				&& ($cachedEntry['fileStat'] ?? null) === $signature
 				&& $cachedEntry['fileHash'] !== self::MISSING_FILE_HASH
@@ -2576,11 +2570,11 @@ private function hashAnalysedFiles(array $analysedFileStats, ?array $cachedDepen
 			}
 
 			$hashes[$file] = $hash;
-			if (!$trustSignatures || $stat['mtime'] >= $now || $stat['ctime'] >= $now) {
+			if ($signature === null) {
 				continue;
 			}
 
-			$this->fileStatSignatures[$file] = $signature;
+			$this->recordedFileStats[$file] = $signature;
 		}
 
 		return $hashes;
@@ -2594,7 +2588,7 @@ private function hashAnalysedFiles(array $analysedFileStats, ?array $cachedDepen
 	 */
 	private function fileStatSignaturesDiffer(array $cachedDependencies): bool
 	{
-		foreach ($this->fileStatSignatures as $file => $signature) {
+		foreach ($this->recordedFileStats as $file => $signature) {
 			if (!array_key_exists($file, $cachedDependencies)) {
 				continue;
 			}
 
@@ -29,7 +29,6 @@
 use function str_contains;
 use function str_starts_with;
 use function substr;
-use function time;
 use function unlink;
 use function unserialize;
 use const DIRECTORY_SEPARATOR;
@@ -49,11 +48,8 @@
  * Reading the directories is what a walk costs - on a tree the size of Drupal core (28k directories)
  * about a second, every run, in the main process and again in the worker that builds the symbol
  * index. What a directory contains changes only when an entry is added, removed or renamed in it,
- * and each of those updates the directory's mtime and ctime, so the listings are kept in tmpDir and
- * a directory whose stat still matches is not read again. ctime cannot be set back by touch or by
- * extracting an archive, and a directory modified in the very second its listing is read is not
- * kept: a second change within that same second would leave its stat unchanged. The same technique
- * is behind git's untracked cache.
+ * so the listings are kept in tmpDir and a directory whose stat signature still matches (see
+ * FileStatSignatures) is not read again. The same technique is behind git's untracked cache.
  *
  * The walk yields what Symfony Finder yields for files()->name()->followLinks() with its default
  * ignores - dot files and VCS directories left out, symlinks followed, files in readdir order - and
@@ -64,7 +60,7 @@
 final class DirectoryWalker
 {
 
-	private const LISTINGS_FORMAT = 'directoryListings-v1';
+	private const LISTINGS_FORMAT = 'directoryListings-v2';
 
 	/** The directories Finder's ignoreVCS() leaves out; the ones starting with a dot are left out anyway. */
 	private const VCS_DIRECTORIES = ['_svn' => true, 'CVS' => true, '_darcs' => true];
@@ -73,12 +69,12 @@ final class DirectoryWalker
 	private array $cachedWalks = [];
 
 	/**
-	 * Directory path => [mtime, ctime, inode, entries]. The entries are the directory's names in
+	 * Directory path => [stat signature, entries]. The entries are the directory's names in
 	 * readdir order, each prefixed by d (directory), f (anything else - Finder's files() only leaves
 	 * out directories, so a broken symlink is a file too) or l (symlink - resolved on every walk,
 	 * because its target can change without this directory changing), joined by NUL.
 	 *
-	 * @var array<string, array{int, int, int, string}>|null
+	 * @var array<string, array{string, string}>|null
 	 */
 	private ?array $listings = null;
 
@@ -88,6 +84,7 @@ final class DirectoryWalker
 	 * @param string $tmpDir where the listings are kept between runs, nowhere when empty
 	 */
 	public function __construct(
+		private FileStatSignatures $fileStatSignatures,
 		#[AutowiredParameter]
 		private string $tmpDir = '',
 	)
@@ -155,7 +152,7 @@ private function walkWithListings(string $directory, array $fileExtensions): ?ar
 
 		$files = [];
 		$visited = [];
-		if (!$this->walkDirectory($directory, Glob::toRegex('*.{' . implode(',', $fileExtensions) . '}'), time(), $files, $visited)) {
+		if (!$this->walkDirectory($directory, Glob::toRegex('*.{' . implode(',', $fileExtensions) . '}'), $this->fileStatSignatures->begin(), $files, $visited)) {
 			return null;
 		}
 
@@ -168,25 +165,26 @@ private function walkWithListings(string $directory, array $fileExtensions): ?ar
 	 * @param list<string> $files
 	 * @param array<string, true> $visited
 	 */
-	private function walkDirectory(string $directory, string $pattern, int $now, array &$files, array &$visited): bool
+	private function walkDirectory(string $directory, string $pattern, FileStatSignatureReader $signatures, array &$files, array &$visited): bool
 	{
 		$stat = @stat($directory);
 		if ($stat === false) {
 			return false;
 		}
 
 		$visited[$directory] = true;
+		$signature = $signatures->fromStat($stat);
 		$listing = $this->listings[$directory] ?? null;
-		if ($listing !== null && $listing[0] === $stat['mtime'] && $listing[1] === $stat['ctime'] && $listing[2] === $stat['ino']) {
-			$entries = $listing[3];
+		if ($signature !== null && $listing !== null && $listing[0] === $signature) {
+			$entries = $listing[1];
 		} else {
 			$entries = $this->readDirectory($directory);
 			if ($entries === null) {
 				return false;
 			}
 
-			if ($stat['mtime'] < $now && $stat['ctime'] < $now) {
-				$this->listings[$directory] = [$stat['mtime'], $stat['ctime'], $stat['ino'], $entries];
+			if ($signature !== null) {
+				$this->listings[$directory] = [$signature, $entries];
 			} else {
 				unset($this->listings[$directory]);
 			}
@@ -213,7 +211,7 @@ private function walkDirectory(string $directory, string $pattern, int $now, arr
 			}
 
 			if ($type === 'd') {
-				if (!$this->walkDirectory($path, $pattern, $now, $files, $visited)) {
+				if (!$this->walkDirectory($path, $pattern, $signatures, $files, $visited)) {
 					return false;
 				}
 
@@ -297,7 +295,7 @@ private function loadListings(): void
 			return;
 		}
 
-		/** @var array<string, array{int, int, int, string}> $listings */
+		/** @var array<string, array{string, string}> $listings */
 		$listings = $data['listings'];
 		$this->listings = $listings;
 	}
 
@@ -0,0 +1,55 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\File;
+
+use function sprintf;
+use function stat;
+use function str_contains;
+
+/**
+ * Signatures of files and directories read after FileStatSignatures::begin(). A signature is null
+ * when the stat cannot vouch for the contents: the caller then neither reuses what it derived from
+ * them before nor keeps the signature for next time.
+ *
+ * That includes a file or directory modified in the second the reading began or later. Timestamps
+ * have a one-second granularity, so it could be written again within that second, after it was
+ * read, and keep its signature over different contents. Everything modified before that second
+ * was read afterwards, so any later change moves its timestamps.
+ */
+final class FileStatSignatureReader
+{
+
+	public function __construct(
+		private int $startedAt,
+		private bool $trusted,
+	)
+	{
+	}
+
+	public function get(string $path): ?string
+	{
+		if (!$this->trusted || str_contains($path, '://')) {
+			return null;
+		}
+
+		$stat = @stat($path);
+		if ($stat === false) {
+			return null;
+		}
+
+		return $this->fromStat($stat);
+	}
+
+	/**
+	 * @param array<int|string, int> $stat what stat() returned for the path
+	 */
+	public function fromStat(array $stat): ?string
+	{
+		if (!$this->trusted || $stat['mtime'] >= $this->startedAt || $stat['ctime'] >= $this->startedAt) {
+			return null;
+		}
+
+		return sprintf('%d:%d:%d:%d:%d', $stat['size'], $stat['mtime'], $stat['ctime'], $stat['ino'], $stat['dev']);
+	}
+
+}
@@ -0,0 +1,33 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\File;
+
+use PHPStan\DependencyInjection\AutowiredService;
+use function time;
+use const DIRECTORY_SEPARATOR;
+
+/**
+ * Tells from its stat alone that a file or directory has not been written to since it was last
+ * read, the way git's index does: its size, mtime, ctime, inode and device are what they were.
+ * ctime cannot be set back the way mtime can (touch, an extracted archive), and a replaced file
+ * has a new inode. Adding, removing or renaming an entry of a directory updates its mtime and
+ * ctime, so a directory whose signature matches still has the entries it had.
+ *
+ * A caller keeps the signature next to what it derived from the contents, and next time reuses
+ * that as long as the signature it gets is the same - see FileStatSignatureReader.
+ */
+#[AutowiredService]
+final class FileStatSignatures
+{
+
+	/**
+	 * To be called before reading the contents the signatures are going to vouch for.
+	 */
+	public function begin(): FileStatSignatureReader
+	{
+		// On Windows, the ctime PHP reports is the creation time, which a file rewritten in place
+		// keeps, and the mtime alone can be set back - nothing can be vouched for there.
+		return new FileStatSignatureReader(time(), DIRECTORY_SEPARATOR === '/');
+	}
+
+}
@@ -36,7 +36,7 @@ protected function setUp(): void
 
 	public function testWalkAlwaysSeesTheCurrentState(): void
 	{
-		$walker = new DirectoryWalker();
+		$walker = new DirectoryWalker(new FileStatSignatures());
 
 		$beforeAdding = $walker->walk($this->directory, ['php']);
 		file_put_contents($this->directory . '/second.php', '<?php');
@@ -48,7 +48,7 @@ public function testWalkAlwaysSeesTheCurrentState(): void
 
 	public function testWalkCachedIsSharedBetweenCalls(): void
 	{
-		$walker = new DirectoryWalker();
+		$walker = new DirectoryWalker(new FileStatSignatures());
 
 		$firstWalk = $walker->walkCached($this->directory, ['php']);
 		file_put_contents($this->directory . '/second.php', '<?php');
@@ -65,7 +65,7 @@ public function testWalkCachedIsSharedBetweenCalls(): void
 
 	public function testCachedWalksAreKeyedByExtensions(): void
 	{
-		$walker = new DirectoryWalker();
+		$walker = new DirectoryWalker(new FileStatSignatures());
 		file_put_contents($this->directory . '/notes.txt', 'x');
 
 		$phpFiles = $walker->walkCached($this->directory, ['php']);
@@ -80,11 +80,11 @@ public function testWalkYieldsWhatFinderYields(): void
 		$tmpDir = $this->createTree();
 
 		$expected = $this->walkWithFinder($this->directory, ['php', 'sh', '']);
-		$fresh = (new DirectoryWalker($tmpDir))->walk($this->directory, ['php', 'sh', '']);
+		$fresh = (new DirectoryWalker(new FileStatSignatures(), $tmpDir))->walk($this->directory, ['php', 'sh', '']);
 		$this->waitUntilTheTreeIsInThePast();
 		// stores the listings, now that they are no longer racy
-		(new DirectoryWalker($tmpDir))->walk($this->directory, ['php', 'sh', '']);
-		$fromListings = (new DirectoryWalker($tmpDir))->walk($this->directory, ['php', 'sh', '']);
+		(new DirectoryWalker(new FileStatSignatures(), $tmpDir))->walk($this->directory, ['php', 'sh', '']);
+		$fromListings = (new DirectoryWalker(new FileStatSignatures(), $tmpDir))->walk($this->directory, ['php', 'sh', '']);
 
 		$this->assertNotSame([], $expected);
 		$this->assertSame($expected, $fresh);
@@ -96,23 +96,23 @@ public function testListingsSeeAddedAndRemovedFiles(): void
 	{
 		$tmpDir = $this->createTree();
 		$this->waitUntilTheTreeIsInThePast();
-		(new DirectoryWalker($tmpDir))->walk($this->directory, ['php']);
+		(new DirectoryWalker(new FileStatSignatures(), $tmpDir))->walk($this->directory, ['php']);
 
 		file_put_contents($this->directory . '/src/Added.php', '<?php');
 		unlink($this->directory . '/src/Nested/Deep.php');
 		rename($this->directory . '/src/Foo.php', $this->directory . '/src/Renamed.php');
 
 		$this->assertSame(
 			$this->walkWithFinder($this->directory, ['php']),
-			(new DirectoryWalker($tmpDir))->walk($this->directory, ['php']),
+			(new DirectoryWalker(new FileStatSignatures(), $tmpDir))->walk($this->directory, ['php']),
 		);
 	}
 
 	public function testReplacedDirectoryIsReadAgain(): void
 	{
 		$tmpDir = $this->createTree();
 		$this->waitUntilTheTreeIsInThePast();
-		(new DirectoryWalker($tmpDir))->walk($this->directory, ['php']);
+		(new DirectoryWalker(new FileStatSignatures(), $tmpDir))->walk($this->directory, ['php']);
 
 		unlink($this->directory . '/src/Nested/Deep.php');
 		rmdir($this->directory . '/src/Nested');
@@ -121,7 +121,7 @@ public function testReplacedDirectoryIsReadAgain(): void
 
 		$this->assertContains(
 			$this->directory . '/src/Nested/Other.php',
-			(new DirectoryWalker($tmpDir))->walk($this->directory, ['php']),
+			(new DirectoryWalker(new FileStatSignatures(), $tmpDir))->walk($this->directory, ['php']),
 		);
 	}