The recovery branch that imports state proof keys for a record found without them did not note that it had queued them, so a second file with the same key queued them again and failed the startup flush, as a second fresh import did before.

When two files in the genesis directory hold the same participation key, the second found the record in the registry cache before the first file's state proof keys had been written, read them as missing and queued them again. The duplicate insert failed the startup flush, which left every imported file in place until the next start. Track the keys added on this start and skip the check for them.

Overwriting the file with zeros only helps on filesystems that write in place, and a crash mid-overwrite left a corrupt key file that needed a rename and cleanup step to avoid failing later starts. Remove the file instead, and drop util.EraseFile and the .erasing rename.