A streaming platform is broadcasting a scheduled cricket match and forecasts 40 million concurrent viewers, but the real number could be double. How should pre-scaled capacity, CDN pre-positioning, ingest redundancy, bitrate ladders, connection limits and feature degradation be planned together?

The first principle: design for the number above the forecast

Record live-sport concurrency has repeatedly exceeded planned figures by large multiples, and a forecast for a scheduled cultural event is among the least reliable numbers in engineering — it depends on the match being close, on a particular player batting, and on a rain delay ending at the right moment.

So the design objective is not "serve 40 million." It is "serve 40 million well, and degrade smoothly rather than fail if it is 80 million." Every mechanism below serves that objective.

Pre-scaling, not autoscaling

Autoscaling reacts on a timescale longer than the arrival spike. Viewers join within a few minutes of the toss, and by the time an autoscaler has observed load, decided, provisioned and warmed instances, the event is already failing.

• Provision to the upper bound before the event, hours early, and accept the cost. For a scheduled event the cost is a known, bounded, one-day number and the alternative is a public failure.
• Warm everything: connection pools, JIT compilation, caches, DNS, TLS session caches.
• Keep autoscaling enabled above the pre-scaled floor, as a safety net rather than as the mechanism.
• Verify the capacity actually exists with the cloud provider in advance — a pre-scaling plan that assumes instance availability at 7pm on match day is a plan with an unverified dependency.

CDN and ingest

• Pre-position everything that exists: player code, images, manifests templates, keys, ad creatives. The video segments cannot be pre-positioned because they do not exist yet, which is the defining constraint of live.
• Origin shielding is mandatory, since every edge in the network wants each new segment simultaneously and without a shield the origin load multiplies by the number of edges and providers.
• Multi-CDN with per-region committed capacity, steering at the manifest level for per-session control.
• Fully redundant ingest with independent paths — separate encoders, separate network routes, separate regions. The contribution feed is a single point of failure for the whole event and deserves more redundancy than anything else in the system.
• Test the failover between ingest paths before the event, on the actual equipment.

The bitrate ladder as the primary degradation lever

A shortened ladder with a defined floor is what converts a capacity shortfall into lower quality rather than rebuffering. Concretely: cap the top rungs per region when capacity is constrained, ensure the lowest rung is genuinely low enough for poor networks, and make the caps changeable per region during the event.

This is the highest-leverage control available, because bandwidth per viewer is the dominant cost and the dominant constraint, and reducing it by a third for everyone is far better than failing a third of viewers.

Connection and session limits

• Concurrent-stream limits per account, enforced, which recovers meaningful capacity at large scale.
• Admission control with a queue if arrival exceeds what the system can onboard, with an honest wait message — a queue is enormously better than a failure, and it must be built beforehand.
• Session resumption, so reconnects after a blip are cheap and do not become a second load event.

The degradation ladder, pre-agreed

Ordered by capacity released, rehearsed, and switchable without a deploy:

Live chat and reactions → statistics and scorecard overlays → personalised rails and recommendations → social features → secondary language audio tracks → top bitrate rungs → ad personalisation, falling back to a default creative.

The video stream itself never degrades below its floor, because that is the product.

What must be rehearsed

A full-scale load test against production weeks in advance, at above the upper bound. A game day exercising the degradation switches. An ingest failover drill. A named commander with the authority to pull rungs without seeking approval, because the event lasts three hours and an approval chain does not fit inside it.

And a change freeze for the surrounding days, since the leading cause of failure at a scheduled peak is not the load but a change made shortly before it.