You have changed my mind, and the sentence that did it is this one:
For this I have to decide which app is the master and other apps have to “blindly” follow.
That is the right model and I did not have it. I was treating “does MojoPad delete files” as one question with one answer, when it is a property of the arrangement — and you are describing two arrangements that genuinely differ. A journal you only ever add to is not the same as a literature folder where things move and go. Deciding that once, per folder, is a better design than me deciding it once for everybody.
You are also right that the way it behaves today is not defensible. Delete a file in Finder and the page stays here — so MojoPad already diverges from the folder it claims to mirror, and quietly. That is worse than either honest answer, because the structure looks like it matches when it does not. Whatever else is decided, that needed fixing.
So: “this folder is the master.” Set on a followed folder, off unless you turn it on, with one confirmation that spells out what dragging then means in Finder terms rather than in ours. With it on, moving a page out of that folder takes the file with it, and a file you delete in Finder takes the page.
One change to what you asked for, and I think you will want it. Neither side destroys anything: the file goes to the Trash, and the page goes to Recently Deleted. That is the same gesture Finder makes, and DEVONthink, and it is why your workflow feels safe there — not because the deletion is instant, but because it is recoverable in the place you would already look. It costs you nothing in how it works and it means a misdrag is an inconvenience rather than a loss.
And one thing it will not do, which is worth stating because it is the part that could actually hurt you. MojoPad will never read “I cannot see this file” as “you deleted this file”. A folder on an external disk, a network share, or a cloud folder that has not finished syncing is routinely unreachable for reasons that have nothing to do with intent — and a rule that replicated absence as deletion would empty a chunk of your wiki because a drive was unplugged. So it will act only when it can read the folder and the file is genuinely no longer in it. One misdrag costs one file; getting that distinction wrong costs a library.
You said it should be the user’s responsibility what happens to the data, and I agree — with the caveat that it should be your decision acting on it, and never an unmounted disk making the decision for you.
Does that shape match how you work? If the Trash step is wrong for you — if you would rather it were final — say so, because that is a decision I would rather take from somebody who lives this way than reason about from the outside.
Mark