On-call rotates weekly across two tiers: a primary who responds, and a secondary who provides backup if the primary can't.
Every service team owns its own on-call. There is no centralized on-call team waking up at 3 a.m. for code they didn't write.
We compensate on-call shifts and we cap rotation frequency. If a team's on-call is too loud, we treat that as a reliability bug and fix it.
