This might be what we want, but it might result in a lot of unnecessary candidate packages on Hackage; especially since the instructions say:

Package successfully uploaded as candidate. You can now preview the result at
'https://hackage.haskell.org/package/ghc-dump-tree-0.2.0.2/candidate'. To
publish the candidate, use 'cabal upload --publish'.

but don't explain how the candidate can be deleted (in fact, the wording suggests to me that --upload will delete the candidate, but it doesn't).

Perhaps a better UI might be cabal upload --publish versus cabal upload --candidate with either --publish or --candidate required.

Pinging @dcoutts and @hvr .