In #3293417: If an update failed to apply don't allow more use of the module, a new service called package_manager.failure_marker was added. All stages now require it to be passed to their constructor.
This service helps site owners detect if staged changes were not successfully copied -- or, worse yet, only partially copied -- into the active directory. These are considered catastrophic failures because the site's code is effectively only half-updated, and Drupal may not even be bootable. (Even if it is, it may not be running the code you expect.) In this situation, site owners should restore their site code and database from a backup.
The service works by putting a file in the active directory just before the staged changes are copied in, and deleting the file when that's all done. If the file exists, Package Manager will refuse to create any new stages, or do any other staging operation, until the file is deleted (i.e., until the site has been restored from a backup).
