Bounded route intake
GPX input is bounded and parsed defensively before accepted data becomes a phone-local route for review and navigation.
Back to selected work
Case study | Android + Wear OS
TrailScope
A local-first trail workout app that defensively parses bounded GPX input, validates phone/watch transfers, checkpoints active workouts, and creates local GPX/FIT output before phone delivery.
- Role
- Product direction; Android, Wear OS, and release tooling.
- Stack
- Kotlin, Android, Wear OS, GPX/FIT, Health Connect.
- Surface
- Mobile app, watch app, shared Kotlin modules, widgets, Wear Tiles.
- Outcome
- Bounded route intake, validated transfers, and an implemented checkpoint recovery path.
Evidence snapshot
A complete route loop, not a single-screen app.
The phone route workflow is the visible entry point. The deeper boundary is the ordered path from bounded GPX input through durable local workout artifacts and a guarded return import.
- Input boundary GPX input is read within bounds and parsed defensively before it becomes phone-local route state.
- Cross-device boundary Shared bounded payload contracts validate route and workout transfers; platform adapters persist the accepted state on each device.
- Durability order Completion stores workout history and local GPX/FIT artifacts before phone delivery, which can remain pending for retry.
- Return-import guard Incoming assets are bounded, FIT structure is checked, and newer workout state is protected from replacement by an older record.
- Evidence boundary The checkpoint restore path is implemented; outdoor and reboot validation remains a release gate rather than a field-proven claim.
- GPX inputLocal file enters the route workflow.
- Bounded defensive parseInput is constrained before use.
- Phone-local routeAccepted route state is stored locally.
- Validated Data Layer payloadShared contracts guard transfer.
- Watch-local routeThe device adapter persists accepted state.
- Recording + periodic checkpointActive work gains a restore point.
- Local GPX/FIT + manifestDurable output exists before delivery.
- Delivery pending or sentConnectivity does not gate local output.
- Bounded phone importReturned assets and FIT structure are checked.
- Newer-state mergeAn older record cannot replace newer state.
Problem
A trail workflow that needs to survive real conditions.
Trail workouts cross fragile boundaries: imported route files, phone-to-watch sync, GPS quality, workout state, and exports that need to remain useful after the activity. TrailScope treats them as one local-first loop centered on an Android phone and paired Wear OS watch, without assuming a hosted account.
System
Mobile, watch, data, recovery, and release readiness.
Validated device handoff
Shared bounded payload contracts validate route and workout transfers, while phone and watch adapters persist state for their own surfaces.
Checkpoint and local output
Active workouts receive periodic checkpoints. Completion stores history and local GPX/FIT artifacts before delivery can be sent or left pending.
Guarded return import
Returned assets are bounded, FIT structure is validated, files are persisted, and a newer-state merge prevents an older record from replacing newer work.
Decisions
Design for recoverable state, not just successful trips.
Local durability before delivery
Restored connectivity is not a prerequisite for a completed local artifact; delivery can remain pending and retry later.
Implemented recovery, bounded claim
Periodic checkpoints and a restore path support interrupted workouts, while outdoor and reboot behavior remains subject to real-device release validation.
Newer workout state wins
The return path structurally validates FIT input and prevents an older imported record from overwriting newer workout state.
Protected detail
Public proof stays at the product-decision level and excludes source, real route data, precise locations, logs, accounts, and release secrets.
Outcome
A focused trail computer with practical ownership boundaries.
TrailScope shows ownership of a cross-device route lifecycle, not a collection of screens. Bounded GPX intake, validated phone/watch handoff, periodic checkpoints, local GPX/FIT output, pending delivery, and a newer-state merge remain one inspectable flow across Android and Wear OS.