Replays cached dry-run diffs so warm dry-runs skip reprocessing unchanged files (9-150x). The replay is only sound if the cache invalidates when a dependency changes, so this also carries the dependency-aware capture it builds on — the correctness prerequisite, originally opened as #8028 and now closed in favour of landing it here. Review order: the dependency capture is the first commit, the replay is the last two.

Problem

Files with a pending diff are never marked clean in dry-run mode — correct, the diff must keep being reported — so every warm dry-run reprocesses them from scratch: parse, full PHPStan scope resolution, every rule. On real projects most warm time is exactly this. laravel/framework src/Illuminate with the prepared sets has 1,526 pending diffs: a warm dry-run costs the same as a cold one (220s vs 240s single process).

The cache was also dependency-blind: a clean file stayed skipped on a warm run even when a dependency changed (e.g. a parent gains : int, so a child can now infer its own return type). A diff cache keyed only on a file's own content would replay that stale diff, so the key has to see dependencies first.

Change

1. Dependency-aware capture. PHPStanNodeScopeResolver runs PHPStan's own DependencyResolver per node and records the surfaced files. Cache entries become {hash, deps:{file:hash}}, re-validated on load; legacy string entries self-upgrade; a failed capture means the file is never cached (no partial sets).

2. Diff replay. Cache the produced FileDiff keyed on the file's own content hash, the parameter hash and one content hash per captured dependency. When everything still matches on the next run, replay the cached diff instead of reprocessing the file — skipping scope resolution entirely:

// ApplicationFileProcessor::processFile()
if ($useDiffCache) {
    $cachedFileProcessResult = $this->dryRunDiffCache->load($file, $configuration);
    if ($cachedFileProcessResult instanceof FileProcessResult) {
        return $cachedFileProcessResult;
    }
}

Dry-run only: write mode always computes fresh. Selective runs (--only, --only-suffix) bypass the cache entirely. --no-diffs results never cross into normal entries. The original hasChanged flag is replayed, since a rule can report line changes while printing identical content. The parameter hash is memoized per process, as computing it serializes the whole parameter bag and the key needs it per file.

Numbers

Output byte-identical to a fresh run in every cache state, verified per measurement. The warm gain scales with how many pending diffs a project has; a fully clean project sees no change. Cold cost is the dependency capture (~7-8% interleaved in this guard-free form); the replay itself adds nothing measurable on top.

Verification

Invalidation is covered end-to-end in tests: own-content change, dependency change (fresh-process simulation), --no-diffs cross-replay, the hasChanged flag round-trip. Replay works in parallel mode (workers save, workers replay).