six-degrees 0.6.0 → 0.8.0

package/lib/csv.js

@@ -1,10 +1,12 @@
 import { scorePerson, curveCutoffs, curvedTier } from './scoring.js';
 import { toIsoDate } from './ingest.js';
-// LinkedIn Connections.csv import — parsed ENTIRELY in the browser.
+// LinkedIn Connections.csv import, read in the browser.
 //
-// Nothing is uploaded and nothing is written to the database: an imported
-// network lives in sessionStorage and disappears when the tab closes. That
-// keeps other people's connection lists off this deployment's Supabase.
+// The file itself never leaves the page. What the map needs about each person
+// goes to this computer's own server, which keeps it in the data folder
+// (csv-network.json, lib/csv-store.js) so it's still there after the window
+// closes. It's never written into the database or mixed with a scanned
+// network, and nothing goes anywhere else.
 //
 // The official export carries six usable columns — First Name, Last Name,
 // URL, Company, Position, Connected On. It has NO profile photos and no rich
@@ -55,7 +57,7 @@ export function scoreRecord(headline, company) {
  * a CSV import uses the app's defaults, never your settings (no company
  * scores, no sector), and the curve is the default, so the first look at any
  * export has a top. Scores → Tiers says so while one is open. Run on the
- * parse (the import page's counts) and on every load (the tab keeps only
+ * parse (the import page's counts) and on every load (the data folder keeps only
  * what the export says, packConnections), so the two always agree.
  */
 function gradeOnCurve(connections) {
@@ -154,20 +156,46 @@ export function parseConnectionsCsv(text) {
   return { connections, skipped, total: connections.length + skipped };
 }
 
-// ── Session-scoped storage (never the database) ────────────────────────────
-export function saveSessionNetwork({ degree1 = [], degree2 = [], source = 'csv' }) {
+// ── Where an open network is kept ──────────────────────────────────────────
+// A CSV import is kept in the data folder through /api/data/csv
+// (lib/csv-store.js) until × beside "Your CSV" removes it. It used to live in
+// sessionStorage and was gone when the window closed (the 1.0 list,
+// 2026-10-03: CSV imports survive closing the window).
+//
+// The sample network stays in this window only. It's a look around, not
+// anyone's network, so it never goes into the data folder, a copy or a backup.
+
+const SAMPLE_KEY = 'six-degrees-sample-network';
+const CSV_ROUTE = '/api/data/csv';
+
+export function saveSampleNetwork({ degree1 = [], degree2 = [] }) {
   try {
-    sessionStorage.setItem(STORAGE_KEY, JSON.stringify({ degree1, degree2, source, importedAt: Date.now() }));
+    sessionStorage.setItem(SAMPLE_KEY, JSON.stringify({ degree1, degree2, source: 'sample', importedAt: Date.now() }));
     return true;
   } catch {
-    return false; // quota — very large networks
+    return false; // storage full or off
   }
 }
 
-// A scored row is ~540 characters and the tab holds ~5 million, which capped an
-// import near 9,000 connections. So the tab keeps only what the export says about
-// each person (~130 characters) and scores it again on load: an export at
-// LinkedIn's own maximum of 30,000 connections fits.
+function sampleOpen() {
+  try { return !!sessionStorage.getItem(SAMPLE_KEY); } catch { return false; }
+}
+
+function sampleNetwork() {
+  try {
+    const parsed = JSON.parse(sessionStorage.getItem(SAMPLE_KEY));
+    return parsed ? { degree1: parsed.degree1 || [], degree2: parsed.degree2 || [], source: 'sample' } : null;
+  } catch { return null; }
+}
+
+function leaveSample() {
+  try { sessionStorage.removeItem(SAMPLE_KEY); } catch { /* storage off: nothing was kept */ }
+}
+
+// The file keeps only what the export says about each person (~130 characters)
+// and the page scores it again on every load, so it always follows the scoring
+// model and LinkedIn's maximum of 30,000 connections is one request of about
+// 4 MB, well under the 10 MB Next reads before middleware (docs/brain/ENDPOINTS.md).
 export function packConnections(connections) {
   return connections.map((c) => [c.id, c.name, c.role, c.company, c.profile_url, c.connected_date]);
 }
@@ -177,41 +205,111 @@ export function unpackConnections(rows = []) {
     .sort((a, b) => b.power_score - a.power_score);
 }
 
-export function saveCsvNetwork(connections) {
-  try {
-    sessionStorage.setItem(STORAGE_KEY, JSON.stringify({
-      packed: packConnections(connections), degree2: [], source: 'csv', importedAt: Date.now(),
-    }));
-    return true;
-  } catch {
-    return false; // quota
-  }
+/**
+ * Which network every page opens on: 'sample', 'csv' or 'own' (the database).
+ * The one rule, so the map, Paths, Settings and who "you" are can't disagree.
+ *
+ * The sample, opened in this window, is shown until it's left. A kept CSV
+ * import is shown only while the database has no 1st-degree people: once you
+ * have scanned your own connections, the scan is your network. When the CSV
+ * lived in the window, closing it handed the map back to the scan by itself;
+ * kept, it would otherwise hide every scan after it for good (the 1.0 review,
+ * 2026-10-03). The file itself stays on the disk, never deleted for you, and
+ * the import page says it's there and offers to remove it.
+ */
+export function openNetworkSource({ sample = false, csvKept = false, scannedFirstDegree = 0 } = {}) {
+  if (sample) return 'sample';
+  if (csvKept && !(Number(scannedFirstDegree) > 0)) return 'csv';
+  return 'own';
 }
 
-export function hasCsvNetwork() {
-  try { return !!sessionStorage.getItem(STORAGE_KEY); } catch { return false; }
+// The kept import, and how many 1st-degree people the database has, asked for
+// once per page: who "you" are, the map, and the Settings sections all ask,
+// and it's the same answer. Forgotten whenever it changes, since a link to
+// another page keeps this module loaded.
+let kept = null;
+function keptCsv() {
+  kept ??= fetch(CSV_ROUTE, { cache: 'no-store' })
+    .then(async (r) => {
+      const j = await r.json().catch(() => ({}));
+      if (!r.ok) return { csv: null, scanned: 0, problem: `Your kept CSV import couldn't be loaded (${j.error || `the app answered ${r.status}`}).` };
+      return { csv: j.csv || null, scanned: Number(j.scanned) || 0, problem: j.problem || null };
+    })
+    // No answer at all: the app isn't running, and nothing else on the page will load either.
+    .catch(() => ({ csv: null, scanned: 0, problem: null }));
+  return kept;
 }
 
-/** 'csv' or 'sample' when this tab holds one, else null — without rescoring it as loadCsvNetwork() does. */
-export function csvNetworkSource() {
-  try {
-    const raw = sessionStorage.getItem(STORAGE_KEY);
-    return raw ? JSON.parse(raw).source || 'csv' : null;
-  } catch { return null; }
+async function opening() {
+  const k = await keptCsv();
+  return { ...k, source: openNetworkSource({ sample: sampleOpen(), csvKept: Boolean(k.csv), scannedFirstDegree: k.scanned }) };
 }
 
-export function loadCsvNetwork() {
+/** The network open instead of the database: the sample or a kept CSV import (openNetworkSource), else null. */
+export async function loadCsvNetwork() {
+  const { source, csv } = await opening();
+  if (source === 'sample') return sampleNetwork();
+  if (source !== 'csv') return null;
+  return { degree1: unpackConnections(csv.connections), degree2: [], source: 'csv', importedAt: csv.importedAt };
+}
+
+/** 'sample' or 'csv' when one is open instead of the database, else null, without scoring it as loadCsvNetwork() does. */
+export async function csvNetworkSource() {
+  const { source } = await opening();
+  return source === 'own' ? null : source;
+}
+
+/**
+ * A CSV import kept here but not shown, because the database has your scanned
+ * connections: `{ people, importedAt }`, else null. The import page says so
+ * and offers to remove it.
+ */
+export async function keptBehindScan() {
+  const { source, csv } = await opening();
+  return csv && source === 'own' ? { people: csv.people, importedAt: csv.importedAt } : null;
+}
+
+/** What × and the import page's Remove ask before a kept import is deleted. */
+export const REMOVE_CSV_QUESTION = 'Remove this CSV import from this computer? Your Connections.csv file isn’t touched, so you can import it again.';
+
+/** Why a kept import is there but can't be opened, or null. Said on the welcome screen, never passed off as no import (TRAPS §7). */
+export async function keptCsvProblem() {
+  return (await keptCsv()).problem;
+}
+
+/** Keep an import, in place of any kept before. Resolves { ok: true, people } or { ok: false, error }, the error fit to show. */
+export async function saveCsvNetwork(connections) {
+  kept = null;
   try {
-    const raw = sessionStorage.getItem(STORAGE_KEY);
-    if (!raw) return null;
-    const parsed = JSON.parse(raw);
-    const degree1 = parsed.packed ? unpackConnections(parsed.packed) : parsed.degree1 || [];
-    return { degree1, degree2: parsed.degree2 || [], source: parsed.source || 'csv' };
-  } catch { return null; }
+    const r = await fetch(CSV_ROUTE, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ connections: packConnections(connections) }),
+    });
+    const j = await r.json().catch(() => ({}));
+    if (!r.ok) return { ok: false, error: j.error || `The import couldn't be kept (the app answered ${r.status}).` };
+    // The import is what the map opens on now, not a sample still open in this window.
+    leaveSample();
+    return { ok: true, people: j.people };
+  } catch {
+    return { ok: false, error: "The import couldn't be kept: Six Degrees didn't answer. Check that it's still running, then try again." };
+  }
 }
 
-export function clearCsvNetwork() {
-  try { sessionStorage.removeItem(STORAGE_KEY); } catch {}
+/** Close what's open: the sample is forgotten by this window; a CSV import is removed from the data folder. Resolves { ok } or { ok: false, error }. */
+export async function closeCsvNetwork(source) {
+  kept = null;
+  if (source === 'sample') {
+    leaveSample();
+    return { ok: true };
+  }
+  try {
+    const r = await fetch(CSV_ROUTE, { method: 'DELETE' });
+    const j = await r.json().catch(() => ({}));
+    return r.ok ? { ok: true } : { ok: false, error: j.error || `The import couldn't be removed (the app answered ${r.status}).` };
+  } catch {
+    return { ok: false, error: "The import couldn't be removed: Six Degrees didn't answer. Check that it's still running, then try again." };
+  }
 }
 
 export const CSV_USER = { id: 'csv-local-user', name: 'You' };

package/lib/data-folder.js

@@ -17,18 +17,29 @@ import { AVATAR_FILE } from './photos.js';
 // import accepts exactly those names.
 export { AVATAR_FILE };
 
+/**
+ * A LinkedIn Connections.csv import, kept so it is still there after the
+ * window closes (lib/csv-store.js). Kept beside the database, never merged
+ * into it: a CSV row has no bridge, no user and no id the scanner made, and
+ * folding it in by profile link is how duplicates and lost rows happened
+ * before (TRAPS §19, §25, §36).
+ */
+export const CSV_NETWORK_FILE = 'csv-network.json';
+
 /**
  * The scanner's notes about the network itself: without them, people whose
  * circles are hidden or half-read would be retried from scratch on the new
  * computer (TRAPS §15, §34). They describe one network's people, so an import
  * replaces them along with the network: this computer's notes would say which
  * pages of the old network's people were read, and the scanner would skip
- * those pages for the new one.
+ * those pages for the new one. A kept CSV import is a network of its own, so
+ * it travels and is replaced the same way (what was here goes to backups/).
  */
 export const NETWORK_FILES = [
   'bridge-progress.json',
   'bridge-skips.json',
   'bridge-unclear.json',
+  CSV_NETWORK_FILE,
 ];
 
 /**
@@ -209,10 +220,15 @@ export function folderOpener(platform = process.platform) {
 /**
  * Open the data folder in Finder (or the Linux file browser). The path is the
  * data folder itself, never anything from a request. Resolves { ok, message }.
+ * `select` is a file in `dir` (a backup, lib/backups.js), its whole path, that
+ * Finder shows selected (`open -R`); a Linux file browser just opens the
+ * folder. The caller builds the path: one built here makes Next's build trace
+ * the whole project into the app (TRAPS §27).
  */
-export function revealFolder(dir, { platform = process.platform, spawnImpl = spawn, waitMs = 3000 } = {}) {
+export function revealFolder(dir, { platform = process.platform, spawnImpl = spawn, waitMs = 3000, select = null } = {}) {
   const cmd = folderOpener(platform);
   if (!cmd) return Promise.resolve({ ok: false, message: 'There is no file browser to open it with on this computer.' });
+  const args = select && cmd === 'open' ? ['-R', select] : [dir];
   return new Promise((resolve) => {
     let timer = null;
     let settled = false;
@@ -224,7 +240,7 @@ export function revealFolder(dir, { platform = process.platform, spawnImpl = spa
     };
     let child;
     try {
-      child = spawnImpl(cmd, [dir], { stdio: 'ignore', detached: true });
+      child = spawnImpl(cmd, args, { stdio: 'ignore', detached: true });
     } catch (err) {
       done({ ok: false, message: `It couldn't be opened (${err.message}).` });
       return;

package/lib/data-import.js

@@ -270,7 +270,7 @@ export function validateImport(file, { applySchema, schemaSql, appVersion, retir
     }
     const present = new Set(objects.filter((o) => o.type === 'table').map((o) => o.name));
     if (!present.has('sd_export_manifest') || !present.has('sd_export_files')) {
-      throw new ImportError("This is a database but not a Six Degrees export, so nothing was imported. Make one on the other computer with Settings → Your data → Save a copy.");
+      throw new ImportError("This is a database but not a Six Degrees export, so nothing was imported. Make one on the other computer with Export backup file… in Settings → Your data.");
     }
     for (const [t, { required, allowed }] of ref.tables) {
       if (!present.has(t)) {
@@ -380,7 +380,7 @@ export function validateImport(file, { applySchema, schemaSql, appVersion, retir
  * @returns what the Settings page shows while the import waits.
  */
 export function stageImport(upload, {
-  dir, applySchema, schemaSql, appVersion, replacedPeople = 0, now = new Date(), retired = RETIRED,
+  dir, applySchema, schemaSql, appVersion, replacedPeople = 0, now = new Date(), retired = RETIRED, restoredFrom = null,
 }) {
   const info = validateImport(upload, { applySchema, schemaSql, appVersion, retired });
   const work = path.dirname(upload);
@@ -436,6 +436,8 @@ export function stageImport(upload, {
     people: info.people,
     photos: info.photos,
     replacedPeople,
+    // A backup from backups/ being put back (lib/backups.js restoreBackup), by its name.
+    ...(restoredFrom ? { restoredFrom } : {}),
   };
   writeFileSync(path.join(work, 'READY'), `${JSON.stringify(ready, null, 2)}\n`);
   // On the disk before import-pending/ appears: the next start moves this
@@ -822,6 +824,7 @@ export function applyPendingImport({ dir, dbFile, now = new Date(), copyDatabase
     people: ready.people ?? null,
     photos: ready.photos ?? null,
     replacedPeople: ready.replacedPeople ?? null,
+    restoredFrom: ready.restoredFrom ?? null,
     keptDatabase: exists(keptDb) ? shown(keptDb) : null,
     keptFiles: exists(keptFiles) ? shown(keptFiles) : null,
     // Set when the database that was here couldn't be read, so it was kept

package/lib/db-client.js

@@ -1,10 +1,15 @@
 import { DatabaseSync } from 'node:sqlite';
-import { mkdirSync, existsSync, readFileSync, writeFileSync, readdirSync, statSync, rmSync } from 'node:fs';
+import { mkdirSync, existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'node:fs';
 import { homedir } from 'node:os';
 import path from 'node:path';
 import { SCHEMA_SQL } from '../db/schema.js';
 import { APP_VERSION } from './app-version.js';
 import { applyPendingImport, recordImport } from './data-import.js';
+import { compareVersions } from './release.js';
+import { durable } from './durable.js';
+import {
+  makeBackup, rotateBackups, dailyBackupIfDue, noteBackupFailure, AUTO_BACKUP_PREFIX,
+} from './backups.js';
 
 // The database lives OUTSIDE the app directory so an installed copy never
 // writes into its own package. Override with SIX_DEGREES_HOME.
@@ -78,7 +83,7 @@ export function getDb() {
   // Before this version changes anything: if a different version opened this
   // data last, keep a copy of it as it was. See backupOnNewVersion().
   try {
-    const saved = backupOnNewVersion(_db, { dir: path.dirname(file), version: APP_VERSION });
+    const saved = backupOnNewVersion(_db, { dir: path.dirname(file), dataDir: dataDir(), version: APP_VERSION });
     if (saved) console.log(`Six Degrees ${APP_VERSION}: backed up your data first → ${saved}`);
   } catch (err) {
     console.error(`Six Degrees: could not back up your data before ${APP_VERSION} (will try again next start): ${err.message}`);
@@ -90,11 +95,39 @@ export function getDb() {
 
   if (imported) {
     try { recordImport(_db, imported); } catch { /* only the Settings page's note is lost */ }
+    // The copy that import kept of what was here joins the rotation (lib/backups.js KEEP).
+    try { rotateBackups(backupsFolder()); } catch { /* tried again after the next backup */ }
+  }
+
+  // Once a day: checked here, as the server opens the data, and after each
+  // scan (app/api/scraper/route.js). No timer: nothing runs that nobody started.
+  try {
+    const daily = backUpDailyIfDue(_db);
+    if (daily) console.log(`Six Degrees: made today's backup → ${daily.file}`);
+  } catch (err) {
+    console.error(`Six Degrees: could not make today's backup (will try again after the next scan or start): ${err.message}`);
   }
 
   return _db;
 }
 
+/** backups/, beside the database (where an import keeps its copy too). */
+export function backupsFolder() {
+  return path.join(path.dirname(dbFile()), 'backups');
+}
+
+/** What lib/backups.js needs to make, check and restore this copy's backups. */
+export function backupOptions(db = getDb()) {
+  return {
+    db, dataDir: dataDir(), backupsDir: backupsFolder(), appVersion: APP_VERSION, schemaSql: SCHEMA_SQL, applySchema,
+  };
+}
+
+/** The daily backup, if one is due (lib/backups.js dailyBackupIfDue). @returns it, or null. */
+export function backUpDailyIfDue(db = getDb(), now = new Date()) {
+  return dailyBackupIfDue({ ...backupOptions(db), now });
+}
+
 /**
  * Every table, index and column this version uses, made if missing. An import
  * is rebuilt into exactly this (lib/data-import.js), so only rows travel.
@@ -120,16 +153,24 @@ function addMissingColumns(db) {
 
 // ── a copy of the data before each new version touches it ──────────────────
 // The first time a version opens a database that a different version (or one
-// from before this existed) used last, it copies the database, as it was, into
-// backups/ — before the schema step or anything else writes to it. VACUUM INTO
-// makes one consistent file even mid-WAL. The newest five automatic copies are
-// kept; anything else in backups/ (copies made by hand) is never touched. The
-// marker is written only after the copy succeeds, so a failed copy (a full
-// disk) is retried at the next start.
+// from before this existed) used last, it backs it up, as it was, into
+// backups/: before the schema step or anything else writes to it. The backup
+// is the whole network, photos and files too (lib/backups.js makeBackup), so
+// Settings → Your data → Restore can put it back. The newest three are kept;
+// anything someone put in backups/ themselves is never touched. The marker is
+// written only after a copy succeeds, so a failed one (a full disk) is retried
+// at the next start.
+//
+// If that backup can't be made or fails its check (a database holding
+// something an export never does, say), the database alone is still copied,
+// as every version before this did: a copy that only a person can put back is
+// better than none before an update. The page says the backup didn't work.
 
-export const AUTO_BACKUP_PREFIX = 'auto-before-';
+export { AUTO_BACKUP_PREFIX };
 
-export function backupOnNewVersion(db, { dir, version, keep = 5, now = new Date() }) {
+export function backupOnNewVersion(db, {
+  dir, version, dataDir: filesDir = dir, now = new Date(), schemaSql = SCHEMA_SQL, applySchema: schemaStep = applySchema,
+}) {
   const marker = path.join(dir, 'app-version');
   let last = null;
   try { last = readFileSync(marker, 'utf8').trim(); } catch { /* first run, or older than this */ }
@@ -141,16 +182,33 @@ export function backupOnNewVersion(db, { dir, version, keep = 5, now = new Date(
   ).get().n > 0;
   if (hasData) {
     const folder = path.join(dir, 'backups');
-    mkdirSync(folder, { recursive: true });
-    const stamp = now.toISOString().replace(/[:.]/g, '-');
-    saved = path.join(folder, `${AUTO_BACKUP_PREFIX}${version}-${stamp}.sqlite`);
-    db.exec(`VACUUM INTO '${saved.replace(/'/g, "''")}'`);
-
-    const autos = readdirSync(folder)
-      .filter((f) => f.startsWith(AUTO_BACKUP_PREFIX) && f.endsWith('.sqlite'))
-      .map((f) => ({ f, at: statSync(path.join(folder, f)).mtimeMs }))
-      .sort((a, b) => b.at - a.at || b.f.localeCompare(a.f));
-    for (const { f } of autos.slice(keep)) rmSync(path.join(folder, f), { force: true });
+    // The data is the last version's, not this one's: say so in the copy, so
+    // that version can restore it if this one has to be put back. (Data a
+    // newer version wrote, or with no marker, is labelled with this version.)
+    const known = /^v?\d+\.\d+\.\d+/.test(last || '') && compareVersions(last, version) <= 0;
+    try {
+      saved = makeBackup('before-update', {
+        db, dataDir: filesDir, backupsDir: folder, appVersion: version, dataVersion: known ? last : version,
+        schemaSql, applySchema: schemaStep, now,
+      }).file;
+    } catch (err) {
+      noteBackupFailure('before-update', err, now);
+      mkdirSync(folder, { recursive: true });
+      saved = path.join(folder, `${AUTO_BACKUP_PREFIX}${version}-${now.toISOString().replace(/[:.]/g, '-')}.sqlite`);
+      // Through the open handle, and synced before it takes its name (the
+      // vacuumCopy pattern, lib/data-import.js).
+      const partial = path.join(folder, `.${path.basename(saved)}.partial`);
+      try {
+        db.exec(`VACUUM INTO '${partial.replace(/'/g, "''")}'`);
+        durable.syncFile(partial);
+        renameSync(partial, saved);
+        durable.syncFolder(folder);
+      } catch (copyErr) {
+        rmSync(partial, { force: true });
+        throw copyErr;
+      }
+      try { rotateBackups(folder, { now }); } catch { /* tried again after the next one */ }
+    }
   }
   writeFileSync(marker, `${version}\n`);
   return saved;

package/lib/demo.js

@@ -4,7 +4,7 @@
 // It exists so a first run has something to show, so screenshots contain no real
 // people, and so the Bridges view can be explored before you have data of your own.
 
-import { saveSessionNetwork } from './csv';
+import { saveSampleNetwork } from './csv';
 
 export const IS_DEMO = process.env.NEXT_PUBLIC_DEMO_MODE === 'true';
 
@@ -19,16 +19,17 @@ let _cache = null;
 export async function loadDemoNetwork() {
   if (_cache) return _cache;
   const res = await fetch('/demo-data.json', { cache: 'no-cache' });
-  if (!res.ok) throw new Error('demo-data.json not found — run: node scripts/gen-synthetic.mjs');
+  if (!res.ok) throw new Error('demo-data.json not found. Run: node scripts/gen-synthetic.mjs');
   const data = await res.json();
   _cache = { degree1: data.degree1 || [], degree2: data.degree2 || [] };
   return _cache;
 }
 
 // Loads the sample into this browser tab and reports how big it is. Nothing is
-// written to the database, so it disappears when the tab closes.
+// written to the database or the data folder, so it disappears when the tab
+// closes (a CSV import is kept; the sample isn't anyone's: lib/csv.js).
 export async function loadSampleIntoSession() {
   const net = await loadDemoNetwork();
-  saveSessionNetwork({ degree1: net.degree1, degree2: net.degree2, source: 'sample' });
+  saveSampleNetwork({ degree1: net.degree1, degree2: net.degree2 });
   return { degree1: net.degree1.length, degree2: net.degree2.length };
 }

package/lib/galaxy-export.js

@@ -8,6 +8,10 @@ import { MAP_LOOK } from './themes.js';
 
 let current = null;   // { svg, stamp: () => text or null, legend: () => [[label, colour]] }
 
+// The small credit in the corner of every picture and video. A shared picture is
+// how someone finds the app, so it names where to get it.
+export const CREDIT = 'sixdegreesapp.com';
+
 export function registerGalaxy(entry) {
   current = entry;
   return () => { if (current === entry) current = null; };
@@ -31,7 +35,10 @@ function svgImage(svg) {
   // The page's font, which the <svg> inherits on screen but not in a file.
   clone.setAttribute('font-family', getComputedStyle(svg).fontFamily || 'system-ui, sans-serif');
   const style = document.createElementNS('http://www.w3.org/2000/svg', 'style');
-  style.textContent = EXPORT_CSS;
+  // The theme's colours (lib/themes.js), which the map reads from the page and a file can't.
+  const root = document.documentElement;
+  const vars = [...root.style].filter((k) => k.startsWith('--sd-')).map((k) => `${k}:${root.style.getPropertyValue(k)}`).join(';');
+  style.textContent = `svg{${vars}}${EXPORT_CSS}`;
   clone.insertBefore(style, clone.firstChild);
   const xml = new XMLSerializer().serializeToString(clone);
   const img = new Image();
@@ -76,7 +83,7 @@ async function drawFrame(ctx, w, h) {
   }
   ctx.textAlign = 'right';
   ctx.fillStyle = 'rgba(255,255,255,0.35)';
-  ctx.fillText('Six Degrees', cw - 16, 24);
+  ctx.fillText(CREDIT, cw - 16, 24);
   ctx.restore();
 }
 

package/lib/galaxy-lab.js

@@ -9,6 +9,9 @@
 
 import { keyFor, score } from './separation.js';
 import { warmthOf } from './linkedin-export.js';
+import { LAYOUT_KEYS, cleanLayouts } from './galaxy-layouts.js';
+import { saveSettings } from './settings-client.js';
+import { reconcileSaved } from './synced-setting.js';
 
 const KEY = 'six-degrees-galaxy-lab';
 const LAYOUTS_KEY = 'six-degrees-galaxy-layouts';
@@ -34,9 +37,6 @@ export const LAB_DEFAULTS = Object.freeze({
   v: 2,             // which defaults a saved setting was made under (2: the branch starts off)
 });
 
-/** The slider settings a saved layout keeps (not whether the lab is on, nor the names switch). */
-const LAYOUT_KEYS = ['gravity', 'rings', 'push', 'pull', 'distance', 'orbit', 'dotSize', 'lines', 'sizeBy', 'names', 'branch', 'colourBy', 'speed', 'loop'];
-
 /** The forces a layout sets, and the ones the Galaxy re-settles for when they change. */
 export const FORCE_KEYS = ['gravity', 'rings', 'push', 'pull', 'distance'];
 
@@ -105,7 +105,10 @@ export function watchLab(f) {
 /** What the Galaxy should use: the sliders while the lab is on, today's layout otherwise (with the names switch). */
 export const effectiveLab = (lab) => (lab.on ? lab : lab.labels === LAB_DEFAULTS.labels ? LAB_DEFAULTS : { ...LAB_DEFAULTS, labels: lab.labels });
 
-// Saved layouts: your own named slider settings, in this browser.
+// Saved layouts: your own named slider settings (lib/galaxy-layouts.js), saved
+// with the network's settings so they travel with a backup or a restore, and
+// copied in this browser to show before the server has answered
+// (lib/synced-setting.js, app/components/ThemeLoader.js).
 let layoutsCache = null;
 const layoutListeners = new Set();
 export function layoutsNow() {
@@ -115,10 +118,21 @@ export function layoutsNow() {
   }
   return layoutsCache;
 }
-function writeLayouts(list) {
+function writeLayouts(list, { save = true } = {}) {
   layoutsCache = list;
   try { localStorage.setItem(LAYOUTS_KEY, JSON.stringify(list)); } catch {}
   layoutListeners.forEach((f) => f());
+  if (save) saveSettings({ galaxyLayouts: list });
+}
+/** The layouts saved with the network (GET /api/settings 'galaxyLayouts'), once the page has them. */
+export function adoptSavedLayouts(saved) {
+  const cached = cleanLayouts(layoutsNow());
+  const { use, save, changed } = reconcileSaved({
+    saved: saved == null ? null : cleanLayouts(saved), cached,
+    isDefault: (list) => list.length === 0, same: (a, b) => JSON.stringify(a) === JSON.stringify(b),
+  });
+  if (save) saveSettings({ galaxyLayouts: cached });
+  if (changed) writeLayouts(use, { save: false });
 }
 export function watchLayouts(f) { layoutListeners.add(f); return () => layoutListeners.delete(f); }
 export function saveLayout(name) {

package/lib/galaxy-layouts.js

@@ -0,0 +1,43 @@
+// The Galaxy's saved layouts (Physics → Save layout): your own named slider
+// settings. Kept with the network's settings (lib/settings.js), so they travel
+// with a backup, an export and a restore; the browser keeps a copy to read
+// before the page has asked the server (lib/galaxy-lab.js). No imports: the
+// server checks a saved list with the same rules the browser keeps it by.
+
+/** The slider settings a saved layout keeps (not whether the lab is on, nor the names switch). */
+export const LAYOUT_KEYS = ['gravity', 'rings', 'push', 'pull', 'distance', 'orbit', 'dotSize', 'lines', 'sizeBy', 'names', 'branch', 'colourBy', 'speed', 'loop'];
+
+/** More than anyone names by hand, and a bound on what a stray request can store. */
+export const MAX_LAYOUTS = 50;
+
+const fine = (v) => (typeof v === 'boolean')
+  || (typeof v === 'number' && Number.isFinite(v) && Math.abs(v) <= 1000)
+  || (typeof v === 'string' && /^[a-z]{1,20}$/i.test(v));
+
+/**
+ * A saved list made safe: each layout a name (1 to 40 characters) and only the
+ * slider settings a layout keeps, each a plain number, word or switch. A name
+ * saved twice keeps its last settings, where the first one stood.
+ */
+export function cleanLayouts(raw) {
+  if (!Array.isArray(raw)) return [];
+  const byName = new Map();
+  for (const item of raw) {
+    const name = typeof item?.name === 'string' ? item.name.trim().slice(0, 40) : '';
+    if (!name || !item.settings || typeof item.settings !== 'object' || Array.isArray(item.settings)) continue;
+    const settings = {};
+    for (const k of LAYOUT_KEYS) if (Object.hasOwn(item.settings, k) && fine(item.settings[k])) settings[k] = item.settings[k];
+    byName.set(name, { name, settings });
+  }
+  return [...byName.values()].slice(0, MAX_LAYOUTS);
+}
+
+/** In lib/settings.js: null until a list is saved on this network, so a browser's own list is saved once. */
+export const GALAXY_LAYOUTS_SETTING = {
+  default: null,
+  parse(value) {
+    if (value === null) return null;
+    if (!Array.isArray(value)) throw new Error('Saved layouts must be a list.');
+    return cleanLayouts(value);
+  },
+};

package/lib/gate.js

@@ -8,10 +8,13 @@
 // /api/update changes the code that will run next, both of which are more power
 // than any of the others, so they sit behind the same gate.
 //
-// The four under /api/data are Settings → Your data: export hands over the
-// whole network in one file, import replaces it, restart stops the server, and
-// reveal starts a process. Reading /api/data itself (sizes, the folder's path)
-// changes nothing and stays open, like every other read.
+// The six under /api/data are Settings → Your data: export hands over the
+// whole network in one file, import replaces it, restart stops the server,
+// reveal starts a process, backup writes the whole network to a file, and
+// restore replaces it with a backup. Reading /api/data itself (sizes, the
+// folder's path, the backups) changes nothing and stays open, like every other read.
+// /api/data/csv keeps, replaces, hands over and removes a CSV import kept in
+// the data folder.
 export const DESTRUCTIVE_ROUTES = [
   '/api/admin-delete',
   '/api/admin-update',
@@ -23,6 +26,9 @@ export const DESTRUCTIVE_ROUTES = [
   '/api/data/import',
   '/api/data/restart',
   '/api/data/reveal',
+  '/api/data/backup',
+  '/api/data/restore',
+  '/api/data/csv',
 ];
 
 const LOOPBACK = new Set(['127.0.0.1', '::1', 'localhost']);