Video upload - one file in, seven encodes out

A creator uploads one file. The service owes them two things that pull in opposite directions: an immediate, durable receipt, and a video that eventually plays everywhere. Everything below follows from separating those two promises.

Functional

• Upload one video file of up to 256 GB and receive a durable receipt before any encoding has started.
• Survive a lost connection: an interrupted upload resumes from the last byte the server acknowledged, not from zero.
• Transcode every accepted upload into a ladder of renditions and package it for both DASH and HLS.
• Extract a poster frame and a scrub-bar storyboard sprite from the source.
• Expose the state of a video - uploading, processing, ready, failed - and the reason for a failure.
• Retain the master so the whole catalogue can be re-encoded when a better codec arrives.

Non-functional

• Upload API availability 99.9 percent monthly. A chunk PUT must be retryable without corrupting the session.
• Time to first playable rendition: p50 under 90 seconds, p95 under 8 minutes. Full ladder p95 under 30 minutes.
• Master durability 11 nines. A lost master is content loss that no backup of the database can undo.
• No accepted byte is ever silently dropped: an upload either becomes a master object or is reported missing.
• Cost per uploaded minute is a tracked, alarmed figure, because it is the dominant variable cost of the product.

Questions to ask before designing this

• What is the size DISTRIBUTION of uploads, not the average? The mean drives storage, the p99 drives chunking and timeouts, and on a video product they are an order of magnitude apart.
• Is the ladder fixed or per-title? Per-title encoding moves the compute bill by 20 to 30 percent and adds a complexity-analysis pass before any encode starts.
• How long must a resumable session stay resumable? Seven days of resumability is seven days of half-uploaded objects you are paying to store and may never complete.
• Do we also have to ingest live? If yes, the segmenter and packager are shared with a system that cannot buffer, and that constraint reaches back into this board.
• What happens to a master after five years - archive tier, or delete it and keep the top rendition as the new source?
• Is the top rung a paid feature? If it has revenue attached, the eager-versus-lazy encoding argument has a different answer.
• Who is allowed to delete a video, and does delete mean the renditions, the master, or both? The answer decides whether the storage curve can ever go down.