A live event moderation queue can receive hundreds of uploads in a few minutes. Processing strictly in arrival order sounds fair, but a single guest sending large videos can delay photographs from everyone else. Unlimited parallelism creates the opposite problem: storage, scanning, and preview workers collapse together.
Separate pipeline stages
Use distinct queues for validation, malware scanning, metadata extraction, preview generation, and human review. Each stage has different resource costs and failure policies.
accepted -> validate -> scan -> derive -> reviewable -> approved
A file should carry a stable media ID and stage version so retries do not produce duplicate derivatives or repeated review entries.
Apply admission control
The control plane should limit active work per event and per contributor session. Admission control does not need to reject every excess upload; it can place the item in a durable waiting state and tell the browser that acceptance succeeded.
Distinguish “accepted but queued” from “processing.” This prevents the UI from showing a stalled progress bar while the system intentionally waits.
Schedule by cost class
Classify photographs, short audio, and video into coarse cost bands. Use weighted scheduling so small items continue to flow while expensive video jobs receive guaranteed capacity.
A simple pattern is separate queues with worker weights, for example six image slots, two audio slots, and two video slots. Revisit weights using observed processing time, not file count alone.
Prevent one contributor from dominating
Round-robin across contributor sessions or use a per-session concurrency cap. The organizer may also assign priority to official staff uploads, but that policy should be explicit and visible in audit records.
Do not use hidden device fingerprints to create fairness identities. An event-local random session is enough for rate and concurrency controls.
Propagate backpressure
When downstream scanning is saturated, upstream derivative workers should slow rather than writing millions of pending messages. Expose queue depth and oldest-item age. Scale on both values: depth alone can look healthy while one poisoned job waits for hours.
Set maximum retry counts and move deterministic failures to a dead-letter path with the media ID, stage, safe error code, and attempt history. Never include signed URLs or private captions in queue logs.
Design the moderator view
The human queue should not reorder itself under the moderator's cursor. Give each item a stable position or a clear “new items” boundary. Show media type, event-local context, processing state, and reason for any automated flag.
Actions must be idempotent. Two moderators approving the same item should converge on one state and produce an audit record, not two notifications.
Recover from worker loss
Use visibility timeouts or leases, renew them during long video work, and make each stage safe to retry. A worker crash after writing a preview but before acknowledging the job should detect and reuse the existing derivative.
Test burst behavior
Replay event-shaped traffic: many photos after a speech, a few large videos, and simultaneous moderator activity. Measure time to first reviewable item, p95 queue age by media type, duplicate work, and fairness across sessions.
I help build Gathmo and have a commercial interest in moderated event media. The Gathmo corporate workflow is one use case; these queue patterns apply to any bursty user-generated-content pipeline.
Backpressure is not a failure. It is the mechanism that preserves predictable service and fair progress when demand exceeds one stage's capacity.
Top comments (0)