Function smudge 

pub fn smudge(
    key: Option<&MasterKey>,
    path: &[u8],
    content: &[u8],
    selected: bool,
    declared_eol: Option<EolMode>,
    autocrlf: Option<&str>,
    core_eol: Option<&str>,
) -> Result<Outcome>

The check-out direction: object database → working tree.

Decides from the file’s own header, never from .git-xcrypt. Git does not promise to write .git-xcrypt before the files it filters, so reading the declaration here would be a race; and a file that was never normalised must never receive a conversion its content did not go through.

Content that is ours and a repository that holds no key are not an error: the stored bytes are handed back with a warning, which is what keeps a repository closed by lock able to check its own files out. See the arm itself for what that costs and why it risks nothing.

Errors

The errors cipher::decrypt reports — a header this build cannot read, another key’s file, or a failed authentication tag.