The recovery branch that imports state proof keys for a record found without them did not note that it had queued them, so a second file with the same key queued them again and failed the startup flush, as a second fresh import did before.

When two files in the genesis directory hold the same participation key, the second found the record in the registry cache before the first file's state proof keys had been written, read them as missing and queued them again. The duplicate insert failed the startup flush, which left every imported file in place until the next start. Track the keys added on this start and skip the check for them.

Overwriting the file with zeros only helps on filesystems that write in place, and a crash mid-overwrite left a corrupt key file that needed a rename and cleanup step to avoid failing later starts. Remove the file instead, and drop util.EraseFile and the .erasing rename.

A record and its state proof keys reach the registry in separate transactions. If the second failed or the node crashed in between, the next start found the record already present, skipped the file, and with the file now erased after import, its only copy of the state proof keys was gone. Import the keys from the file when the registry record lacks them.

A crash while an imported file was being overwritten left a zero-filled .partkey file that sqlite rejects as not a database, which failed every later start. Rename the file to *.partkey.erasing before overwriting it, and erase any such leftover at startup.