[BUG] 409 "Cannot publish over previously staged version" for a package that never used staged publishing

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

@rspack/binding-linux-x64-musl@2.2.0-beta.0 cannot be published. Every attempt returns:

409 Conflict - PUT https://registry.npmjs.org/@rspack%2fbinding-linux-x64-musl
Cannot publish over previously staged version "2.2.0-beta.0".

We never used staged publishing — no npm stage publish, and it is not enabled for the package
or the @rspack org. Publishing is done from GitHub Actions via OIDC trusted publishing with
pnpm publish -r --tag beta --provenance (pnpm 11.8.0, Node 24.19.0).

The version does not exist as a published version (npm view → E404, absent from the packument
and from /-/npm/v1/attestations), and it does not appear as a staged version either —
npm stage list returns nothing, filtered by package or unfiltered, from a maintainer account.
So there is no stage-id to pass to npm stage reject, and no way for us to clear it.

The first publish that triggered this reported success and the process went on to publish the
next package normally; that one is live. Only this package ended up wedged.

Failing run: https://github.com/web-infra-dev/rspack/actions/runs/32102630939

Expected Behavior

No response

Steps To Reproduce

1. In this environment...
2. With this config...
3. Run '...'
4. See error...

Environment

• npm:
• Node.js:
• OS Name:
• System Model Name:
• npm config:

; copy and paste output from `npm config ls` here

Start by reproducing the failed publish from the linked GitHub Actions run and compare the package's registry state with npm stage list and npm stage reject. Trace the npm CLI handling of the staged-version conflict and determine why a package absent from both the packument and staged-version listing is rejected. Done means identifying a reproducible cause and adding a regression test for the affected publish path.