Denying a full read of a lockfile is cheap to get right, but a hook that guesses at size will wave through a 20 KB generated file as often as it blocks a bad one. Deny rules are blunt too, at least they're predictable. If the hook gets it wrong, the model burns a turn arguing with it before doing the grep you wanted.