On-call is an architecture signal

Ask to see two artifacts before forming an opinion about a system: the architecture diagram and the last quarter's paging history. When they disagree, believe the pager. The diagram records intentions; the pager records where the intentions leak.

This framing is the opposite of how most organizations treat on-call, which is as a staffing problem with an empathy component: tune the rotation, spread the load, buy the pizza. Necessary, all of it, but downstream. A rotation is a queue in the queueing-theory sense, and when a queue backs up, adding servers is what you do after asking why the arrival rate is what it is. The arrival rate is architecture.

The signal is richer than raw page counts, and three patterns carry most of the information. Recurring pages from one component are the system saying a boundary is wrong or a dependency is mis-trusted; the classic case is the service that pages its owners about every downstream wobble because it never learned to shed or degrade, a failure of design that no amount of runbook polish converts into health. Pages that require a specific person are the system saying knowledge lives in a head instead of in the design; that is key-person risk measured empirically, one 3 a.m. at a time. And pages that resolve themselves before anyone acts are the system saying the alerting encodes fear rather than symptoms. The Google SRE book's advice here remains the standard: page on symptoms users feel, not on causes you suspect.

Treating the pager as review input changes some rituals in practical ways. Postmortems stop terminating at "add an alert" (which raises arrival rate) and start terminating, at least sometimes, at "remove this failure mode" (which is architecture). Quarterly planning gets a page-budget line: the teams this writer trusts most set an explicit ceiling, and when reality exceeds it, roadmap capacity converts to reliability work automatically, no negotiation each time. The conversion rule matters more than the number; it makes the signal impossible to ignore politely.

There is an organizational honesty test buried here too. Who carries the pager for a component is the truest ownership record in the company, far more accurate than the service catalog. A system "owned" by one team that reliably pages another has an org-chart fiction in it, the kind Conway's law eventually invoices.

The quiet corollary: a system that never pages is also emitting a signal, and it is worth reading rather than assuming. Sometimes it means mature engineering. Sometimes it means nobody is looking, or the danger pools where a quarter's worth of silence precedes the incident that makes the news. Silence is data with wide error bars.

The pager is crude, interruptive and unloved, which is exactly why it is trustworthy: nobody performs for it. Architecture reviews consider what a system should be. The rotation knows what it is. The discipline is simply to route that knowledge somewhere with a budget attached, instead of somewhere with a pizza.