Function select 

pub fn select(enumeration: &Enumeration, selection: &Selection) -> Selected

Applies a selection to an enumeration.

The vendor and env filters apply to both lists, not only to the ignored one. The guard is about what the file is worth, and an untracked-but-not-ignored .env is the most precious kind rather than the least: it is the one git is not even hiding.

Why an entry has to be judged twice

git clean emits a whole directory whenever everything inside it is removable, so an entry is not a description of its own contents. docker/ arrives as one line and may hold a docker/.env; pkg/ arrives as one line and may hold a pkg/node_modules. Judging only the emitted path deletes both while the same run reports, truthfully as far as it knows, that env files were held back.

So every directory entry is also asked what it hides, and one that hides something not opted in is held back whole. Held back rather than expanded, because expanding would mean deciding for ourselves what inside it is removable — which is the reimplementation of git clean this mode exists to avoid.

git cannot be made to do this itself, and it is worth recording why so nobody retries it. git clean -n -d -e '*.env*' really does expand around the pattern, and for the untracked pass it is exactly right. But under -X the same flag inverts: -e adds to the ignore rules and -X removes what is ignored, so the protected pattern becomes a target. A :(exclude) pathspec does not stop the collapse at all. And the one form that protects both, -d -x -e <pattern>, merges untracked and ignored into a single pass — which collapses a mixed directory across the two classes and reintroduces the exact .nx bug this module’s header exists to describe. All three measured against real git.