Exactly one visible primary per view region. Danger only inside a confirm flow, never a resting action. Sentence case, verb-first — never OK/Submit.
Default 32px; small 28px for embedded toolbars (G1-5).
Only universally understood glyphs; always a tooltip + aria-label; hit area ≥32px desktop / 44px touch.
No permission → the action is ABSENT, not disabled. Temporarily unavailable → disabled with a tooltip that names the unblock (K1).
Input disabled + leading spinner, label text unchanged — no width jump (K1). Full color: an operation in progress isn't an unavailable action (the 45% wash is true-disabled only — July 6 feedback). Nothing under 300ms shows a spinner (§2).