never a modal for anything reversible
A modal stops the whole app to ask about something you can undo in one click. Confirms are reserved for the irreversible: cancelling a PO, deleting a tag with dependents.
a toast is never the only copy
Everything a toast says also lands somewhere permanent — the run, the audit log, the staged queue. Miss the toast and you lose nothing.
errors do not expire
Successes fade after six seconds. Failures stay until dismissed, because an error nobody read is an error nobody fixed.
at most three at once
Beyond three they stack into one summary line. Bottom right, above the footer, clear of the command palette.