npm ci integrity mismatch during dependency restoration

When performing a clean installation using npm ci, the tool relies on SHA-512 integrity hashes stored within the package-lock.json to validate downloaded tarballs. This process ensures that the local node_modules state matches the state recorded during the initial installation.

There is uncertainty regarding how npm handles scenarios where the local global cache contains a package that does not match the integrity hash in the lockfile. While npm cache verify can check the health of the cache itself, the behavior during a standard restoration flow—specifically whether npm forces a fresh fetch from the registry or fails immediately upon a checksum mismatch—is not clearly defined.

How does npm resolve a conflict between a corrupted local cache entry and the lockfile integrity hash during a clean install?
Is there a specific flag to force a re-download of all packages without manually clearing the global cache directory?