@@ -6,6 +6,16 @@ All notable changes follow [Keep a Changelog](https://keepachangelog.com/en/1.1.
 
 ### Added
 
+- **The routing key goes back onto the stick it came from.** Configuring this car meant a key on
+  a USB stick, because typing sixty characters on this head unit is not something anyone does
+  twice — and there was no way back out, so a second car, a factory reset or the unstable
+  channel, which is a separate app with its own storage, meant typing it anyway. *Export to USB*
+  writes the same `key = value` file *Import from USB* reads, under one fixed name so a stale
+  export cannot be picked up later, and to a removable volume only: the keys are not copied into
+  a second unencrypted place on the car. The file carries them in clear text, which is what a
+  file this app can import has to be — so the file says so in its own header, and the screen says
+  so when the export lands. Parked only, like everything else on that screen.
+
 - **One drive answers eight questions, on the unstable channel only.** Eleven tickets ended
   "verified on a laptop, never on the car", and each named a different question; answered one
   at a time they would cost eight evenings. There is now one toggle on the evidence screen
 
@@ -166,6 +166,12 @@ and no query. The default is HeiGIT's own host: `api.openrouteservice.org` was d
 config file still naming it will stop working. The key is stored encrypted through the Android keystore, is never displayed
 again, never written to a log, and never included in a diagnostic export.
 
+**Export to USB** writes that same file back out, as `evchargepilot-routing.txt` on the first
+writable USB stick — for a second car, after a factory reset, or for the unstable channel, which
+keeps its own separate configuration. It is the one way the key leaves the car, it happens only
+when you ask for it while parked, and the file holds your keys in clear text: from then on the
+stick is the secret. The file says so in its own header.
+
 Free-tier allowances, as published by ORS: 2000 directions requests a day and 40 in any rolling
 60 seconds, counted from your first request rather than from midnight. The app counts its own
 requests and refuses before the server does, and every request follows a driver action — nothing
 
@@ -9,6 +9,7 @@ import android.os.IBinder
 import androidx.appcompat.app.AppCompatActivity
 import com.evsuite.chargepilot.databinding.ActivityRoutingSettingsBinding
 import com.evsuite.chargepilot.route.RoutingConfig
+import com.evsuite.chargepilot.route.RoutingConfigExport
 import com.evsuite.chargepilot.route.RoutingConfigImport
 import com.evsuite.chargepilot.route.RoutingCredentials
 import java.util.concurrent.Executors
@@ -24,7 +25,8 @@ import java.util.concurrent.Executors
  * **The key is never displayed back.** The field starts empty even when a key is stored, the
  * status line says configured or not and never shows a value, and nothing here reaches
  * `AppLogger` or the diagnostic export. A screen that can show a secret is a screen that shows
- * it to a passenger with a phone camera.
+ * it to a passenger with a phone camera. The one copy that leaves is the export, which the
+ * driver asks for by hand and which lands on their own stick, never on this screen.
  *
  * Parked-only, like every other driver action in this app: entering a key means a keyboard.
  * Clearing one does not, which is why it stays available — a driver who wants their key off the
@@ -77,6 +79,7 @@ class RoutingSettingsActivity : AppCompatActivity() {
         binding.backAction.setOnClickListener { finish() }
         binding.routingSaveAction.setOnClickListener { save() }
         binding.routingImportAction.setOnClickListener { import() }
+        binding.routingExportAction.setOnClickListener { export() }
         binding.routingClearAction.setOnClickListener { clear() }
         binding.routingBaseUrlInput.setText(RoutingCredentials.baseUrl(this))
         render()
@@ -164,6 +167,37 @@ class RoutingSettingsActivity : AppCompatActivity() {
         }
     }
 
+    /**
+     * The same file back out, so a second car — or the unstable channel, which is a separate
+     * application id with its own preferences — does not mean typing the key again.
+     *
+     * A removable volume only: writing the keys into this app's private folder would be a second
+     * unencrypted copy nobody asked for and nobody could reach. The stick then carries the keys
+     * in clear text, which is what the announcement says.
+     */
+    private fun export() {
+        val config = RoutingCredentials.snapshot(this)
+        if (config.isEmpty()) {
+            announce(getString(R.string.routing_export_empty))
+            return
+        }
+        val roots = DiagnosticUsbStorage.roots(this)
+        disk.execute {
+            val written = roots.firstNotNullOfOrNull { root ->
+                DiagnosticUsbStorage.writableTarget(this, root)
+                    ?.let { RoutingConfigExport.write(it, config) }
+            }
+            runOnUiThread {
+                if (isFinishing || isDestroyed) return@runOnUiThread
+                if (written == null) {
+                    announce(getString(R.string.routing_export_failed))
+                } else {
+                    announce(getString(R.string.routing_export_done, written.name))
+                }
+            }
+        }
+    }
+
     private fun clear() {
         RoutingCredentials.clear(this)
         binding.routingKeyInput.text?.clear()
@@ -191,6 +225,7 @@ class RoutingSettingsActivity : AppCompatActivity() {
         binding.routingBaseUrlLayout.isEnabled = editable
         binding.routingSaveAction.isEnabled = editable
         binding.routingImportAction.isEnabled = editable
+        binding.routingExportAction.isEnabled = editable
 
         binding.routingStatus.text = message ?: when (gate) {
             ParkedDeletionGate.MOVING -> getString(R.string.routing_moving)
 
@@ -0,0 +1,64 @@
+package com.evsuite.chargepilot.route
+
+import java.io.File
+import java.io.FileOutputStream
+import java.io.IOException
+
+/**
+ * Writing the configuration back out to a USB stick, the exact file [RoutingConfigImport] reads.
+ *
+ * The driver configured this car from a stick; a second car, a factory reset or the unstable
+ * channel — a separate application id with its own preferences — means configuring it again, and
+ * this head unit's keyboard makes retyping a 60-character key an unreasonable thing to ask twice.
+ *
+ * **This file carries the keys in clear text**, because that is what a file the app can import
+ * has to be. The stick is now the secret: the header says so in the file itself, and the driver
+ * is told so on screen. Nothing else about the car goes in — no trips, no positions, no
+ * diagnostics, only the four values the settings screen already owns.
+ */
+object RoutingConfigExport {
+
+    /** One fixed name, overwritten: several dated exports and an import picks the oldest one. */
+    const val FILE_NAME = "evchargepilot-routing.txt"
+
+    /**
+     * `key = value` in the spelling [RoutingConfig.parse] reads first, with a comment header a
+     * driver reading the stick on a laptop cannot miss. Absent values are left out rather than
+     * written empty, so importing this file back cannot blank a key it never carried.
+     */
+    fun format(config: RoutingConfig): String = buildString {
+        appendLine("# EVChargePilot routing configuration.")
+        appendLine("# It contains your API keys in clear text: this stick is now a secret.")
+        appendLine("# Import it with 'Import from USB' on the routing key screen.")
+        config.apiKey?.let { appendLine("ors_api_key  = $it") }
+        config.baseUrl?.let { appendLine("ors_base_url = $it") }
+        config.chargerApiKey?.let { appendLine("ocm_api_key  = $it") }
+        config.chargerBaseUrl?.let { appendLine("ocm_base_url = $it") }
+    }
+
+    /**
+     * Writes [config] into [directory], replacing an earlier export. Temp file then rename, so a
+     * stick pulled mid-write leaves either the old configuration or the new one, never half a key.
+     */
+    fun write(directory: File, config: RoutingConfig): File? {
+        if (!directory.isDirectory || config.isEmpty()) return null
+        val target = File(directory, FILE_NAME)
+        val temp = File(directory, ".$FILE_NAME.${System.nanoTime()}.tmp")
+        return try {
+            FileOutputStream(temp).use { output ->
+                output.write(format(config).toByteArray(Charsets.UTF_8))
+                output.flush()
+                output.fd.sync()
+            }
+            // FAT has no atomic replace: the old file goes before the new one takes its name.
+            target.delete()
+            if (temp.renameTo(target)) target else null
+        } catch (_: IOException) {
+            null
+        } catch (_: SecurityException) {
+            null
+        } finally {
+            if (temp.exists()) temp.delete()
+        }
+    }
+}
@@ -14,9 +14,10 @@ import com.evsuite.hardware.AppLogger
  * matters more than the encryption: a head unit with a broken keystore must end up with a
  * working app, not a crash in a car.
  *
- * **The key never leaves this file.** Not into `AppLogger`, not into a diagnostic export, not
- * into the USB bundle. `DiagnosticExporter` reads nothing from here and must keep not reading
- * anything from here.
+ * **The key never leaves this file on its own.** Not into `AppLogger`, not into a diagnostic
+ * export, not into the USB bundle. `DiagnosticExporter` reads nothing from here and must keep
+ * not reading anything from here. The single way out is [snapshot], and only a driver who is
+ * parked and taps *Export to USB* asks for it.
  */
 object RoutingCredentials {
 
@@ -88,6 +89,23 @@ object RoutingCredentials {
         return Values(key, base, OpenChargeMap.HEADER)
     }
 
+    /**
+     * Everything stored, for the driver's own export and nothing else. This is the one call that
+     * hands the keys to a caller that is not building a request: it must not be logged, shown or
+     * put in a diagnostic bundle. Unset values stay null, so exporting and importing back is not
+     * a way to write defaults over a self-hosted address.
+     */
+    fun snapshot(context: Context): RoutingConfig {
+        val prefs = preferences(context)
+        fun value(key: String): String? = prefs.getString(key, null)?.trim()?.ifEmpty { null }
+        return RoutingConfig(
+            apiKey = value(KEY_API_KEY),
+            baseUrl = value(KEY_BASE_URL),
+            chargerApiKey = value(KEY_CHARGER_API_KEY),
+            chargerBaseUrl = value(KEY_CHARGER_BASE_URL),
+        )
+    }
+
     fun isConfigured(context: Context): Boolean = read(context) != null
 
     fun isChargerConfigured(context: Context): Boolean = readCharger(context) != null
 
@@ -146,6 +146,15 @@
                     android:layout_weight="1"
                     android:text="@string/routing_action_import" />
 
+                <com.google.android.material.button.MaterialButton
+                    android:id="@+id/routingExportAction"
+                    style="@style/Widget.EV.Button.Outlined"
+                    android:layout_width="0dp"
+                    android:layout_height="@dimen/touch_target"
+                    android:layout_marginStart="@dimen/spacing_md"
+                    android:layout_weight="1"
+                    android:text="@string/routing_action_export" />
+
                 <com.google.android.material.button.MaterialButton
                     android:id="@+id/routingClearAction"
                     style="@style/Widget.EVChargePilot.Button.Danger"
 
@@ -287,6 +287,7 @@ Consommation %6$s %% par km</string>
     <string name="routing_helper_base_url">Laissez tel quel pour le service hébergé par HeiGIT, ou pointez vers votre propre instance.</string>
     <string name="routing_action_save">Enregistrer</string>
     <string name="routing_action_import">Importer depuis USB</string>
+    <string name="routing_action_export">Exporter vers USB</string>
     <string name="routing_action_clear">Supprimer</string>
     <string name="routing_configured">Configuré · %1$s</string>
     <string name="routing_absent">Non configuré. Saisissez une clé ou importez-la depuis une clé USB.</string>
@@ -298,6 +299,9 @@ Consommation %6$s %% par km</string>
     <string name="routing_base_url_refused">Adresse refusée : %1$s. Elle doit être en https, sans identifiants ni paramètres.</string>
     <string name="routing_import_none">Aucun fichier de configuration trouvé. Placez sur une clé USB un fichier contenant la ligne ors_api_key = votre-clé.</string>
     <string name="routing_import_done">Importé depuis %1$s.</string>
+    <string name="routing_export_empty">Rien à exporter pour l’instant. Saisissez d’abord une clé.</string>
+    <string name="routing_export_failed">Aucune clé USB accessible en écriture. Insérez-en une et réessayez.</string>
+    <string name="routing_export_done">Exporté vers %1$s sur la clé USB. Ce fichier contient vos clés d’API en clair : gardez la clé USB comme vous garderiez ces clés.</string>
     <string name="routing_privacy">Seuls la destination saisie, la position du véhicule et le profil de la route sortent de la voiture. Aucun trajet, aucune charge, aucune vitesse, aucun rapport de diagnostic ni identifiant n’est transmis. La clé est stockée chiffrée, n’est jamais journalisée et n’apparaît dans aucun export de diagnostic.</string>
     <string name="routing_refused_busy">Une requête est déjà en cours. Attendez sa réponse.</string>
     <string name="routing_refused_quota_minute">Trop de requêtes en peu de temps. Réessayez dans %1$s s.</string>
 
@@ -292,6 +292,7 @@ Spending %6$s %% per km</string>
     <string name="routing_helper_base_url">Leave as it is for HeiGIT’s hosted service, or point it at your own instance.</string>
     <string name="routing_action_save">Save</string>
     <string name="routing_action_import">Import from USB</string>
+    <string name="routing_action_export">Export to USB</string>
     <string name="routing_action_clear">Remove</string>
     <string name="routing_configured">Configured · %1$s</string>
     <string name="routing_absent">Not configured. Enter a key, or import one from a USB stick.</string>
@@ -303,6 +304,9 @@ Spending %6$s %% per km</string>
     <string name="routing_base_url_refused">Address refused: %1$s. It must be https, with no credentials and no query.</string>
     <string name="routing_import_none">No configuration file found. Put one on a USB stick with a line reading ors_api_key = your-key.</string>
     <string name="routing_import_done">Imported from %1$s.</string>
+    <string name="routing_export_empty">Nothing to export yet. Enter a key first.</string>
+    <string name="routing_export_failed">No USB stick that can be written to. Insert one and try again.</string>
+    <string name="routing_export_done">Exported to %1$s on the USB stick. That file holds your keys in clear text: keep the stick as you would keep them.</string>
     <string name="routing_privacy">Only the destination you type, the car’s position and the road profile ever leave the car. No trip, charge, speed, diagnostic bundle or identifier is sent anywhere. The key is stored encrypted, never written to a log and never included in a diagnostic export.</string>
     <string name="routing_refused_busy">A request is already in flight. Wait for it.</string>
     <string name="routing_refused_quota_minute">Too many requests just now. Try again in %1$s s.</string>
 
@@ -0,0 +1,58 @@
+package com.evsuite.chargepilot.route
+
+import java.io.File
+import java.nio.file.Files
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+class RoutingConfigExportTest {
+
+    private fun stick(): File = Files.createTempDirectory("routing-export").toFile()
+
+    @Test
+    fun `an exported file is a file this app can import back`() {
+        val config = RoutingConfig(
+            apiKey = "5b3ce3597851110001cf6248abc",
+            baseUrl = "https://ors.example.org",
+            chargerApiKey = "0a1b2c3d",
+            chargerBaseUrl = "https://ocm.example.org",
+        )
+        val directory = stick()
+
+        val written = RoutingConfigExport.write(directory, config)
+
+        assertEquals(RoutingConfigExport.FILE_NAME, written?.name)
+        val found = RoutingConfigImport.search(listOf(directory))
+        assertEquals(config, found?.config)
+    }
+
+    @Test
+    fun `values that were never set stay out, so importing back blanks nothing`() {
+        val text = RoutingConfigExport.format(RoutingConfig(apiKey = "abc"))
+
+        assertEquals("abc", RoutingConfig.parse(text).apiKey)
+        assertNull(RoutingConfig.parse(text).baseUrl)
+        assertNull(RoutingConfig.parse(text).chargerApiKey)
+    }
+
+    @Test
+    fun `a second export replaces the first, so an import cannot pick a stale key`() {
+        val directory = stick()
+        RoutingConfigExport.write(directory, RoutingConfig(apiKey = "old"))
+
+        RoutingConfigExport.write(directory, RoutingConfig(apiKey = "new"))
+
+        assertEquals(1, directory.listFiles()?.size)
+        assertEquals("new", RoutingConfigImport.search(listOf(directory))?.config?.apiKey)
+    }
+
+    @Test
+    fun `an empty configuration writes no file at all`() {
+        val directory = stick()
+
+        assertNull(RoutingConfigExport.write(directory, RoutingConfig()))
+
+        assertEquals(0, directory.listFiles()?.size)
+    }
+}