Issue #3266092: Make sure staging root is unique for each Drupal site

package_manager/src/Stage.php

@@ -41,13 +41,14 @@ use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
  * before any such operations are done. A stage is claimed by presenting a
  * unique token that is generated when the stage is created.
  *
- * Although a site can only have one staging area, it is possible, but unlikely,
- * for privileged users to destroy a stage created by another user, then create
- * their own, new stage. To prevent such situations from putting the file system
- * into an indeterminate state, each staging area lives in its own directory
- * with a randomly generated name. For additional cleanliness, all staging areas
- * created by a specific site live in a single directory, called the "staging
- * root" and identified by the site UUID, which is deleted when any stage
+ * Although a site can only have one staging area, it is possible for privileged
+ * users to destroy a stage created by another user. To prevent such actions
+ * from putting the file system into an uncertain state (for example, if a stage
+ * is destroyed by another user while it is still being created), the staging
+ * directory has a randomly generated name. For additional cleanliness, all
+ * staging directories created by a specific site live in a single directory,
+ * called the "staging root" and identified by the UUID of the current site
+ * (e.g. `/tmp/.package_managerSITE_UUID`), which is deleted when any stage
  * created by that site is destroyed.
  */
 class Stage {
@@ -512,7+513,7 @@
    *
    * @return string
    *   The absolute path of the directory where changes should be staged.
    *
    * @throws \LogicException
    *   If this method is called before the stage has been created or claimed.
    */