Absence is not deletion
Dir Diode compares a shallow workspace with a corresponding folder in a parent workspace. Promotion copies selected changes toward the parent; rejection resets selected work in the other direction. Nothing is copied automatically.
The file-state model distinguishes modified, shallow-only, parent-only, same, and blocked objects. A file missing from the shallow workspace does not delete the parent's copy. That rule makes the overlay relationship concrete and avoids turning omission into destructive intent.
Check the evidence at write time
Each displayed difference carries both sides' SHA-256 hashes. Applying a change rechecks those hashes and reports a conflict if the files changed after inspection. Writes use a temporary file and rename; batches are serialized, preflighted, and rolled back on failure.
Replaced bytes go into a content-addressed archive, and successful batches append to an audit log. The service rejects symlinks and validates paths against configured roots.
An included demonstration directory contains modified, new, missing, and identical files, so the operator can exercise the state model on a disposable example.
Be precise about the guarantee
The README acknowledges a remaining filesystem race between the final check and rename. Portable filesystems do not provide a universal compare-and-swap write primitive. Rechecking hashes narrows that window; archived bytes and guarded rollback provide recovery options. The result is explicit, reviewable promotion rather than an unqualified promise of perfect filesystem isolation.