diff --git a/scripts/repository/commit_hook.php b/scripts/repository/commit_hook.php
index dabf9320a9..386075111d 100755
--- a/scripts/repository/commit_hook.php
+++ b/scripts/repository/commit_hook.php
@@ -1,139 +1,140 @@
 #!/usr/bin/env php
 <?php
 
 $root = dirname(dirname(dirname(__FILE__)));
 require_once $root.'/scripts/__init_script__.php';
 
 if ($argc < 2) {
   throw new Exception(pht('usage: commit-hook <callsign>'));
 }
 
 $engine = new DiffusionCommitHookEngine();
 
 $repository = id(new PhabricatorRepositoryQuery())
   ->setViewer(PhabricatorUser::getOmnipotentUser())
   ->withCallsigns(array($argv[1]))
   ->executeOne();
 
 if (!$repository) {
   throw new Exception(pht('No such repository "%s"!', $callsign));
 }
 
 if (!$repository->isHosted()) {
   // This should be redundant, but double check just in case.
   throw new Exception(pht('Repository "%s" is not hosted!', $callsign));
 }
 
 $engine->setRepository($repository);
 
 
 // Figure out which user is writing the commit.
 
 if ($repository->isGit() || $repository->isHg()) {
   $username = getenv(DiffusionCommitHookEngine::ENV_USER);
   if (!strlen($username)) {
     throw new Exception(
       pht('usage: %s should be defined!', DiffusionCommitHookEngine::ENV_USER));
   }
 
-  // TODO: If this is a Mercurial repository, the hook we're responding to
-  // is available in $argv[2]. It's unclear if we actually need this, or if
-  // we can block all actions we care about with just pretxnchangegroup.
+  if ($repository->isHg()) {
+    // We respond to several different hooks in Mercurial.
+    $engine->setMercurialHook($argv[2]);
+  }
 
 } else if ($repository->isSVN()) {
   // NOTE: In Subversion, the entire environment gets wiped so we can't read
   // DiffusionCommitHookEngine::ENV_USER. Instead, we've set "--tunnel-user" to
   // specify the correct user; read this user out of the commit log.
 
   if ($argc < 4) {
     throw new Exception(pht('usage: commit-hook <callsign> <repo> <txn>'));
   }
 
   $svn_repo = $argv[2];
   $svn_txn = $argv[3];
   list($username) = execx('svnlook author -t %s %s', $svn_txn, $svn_repo);
   $username = rtrim($username, "\n");
 
   $engine->setSubversionTransactionInfo($svn_txn, $svn_repo);
 } else {
   throw new Exception(pht('Unknown repository type.'));
 }
 
 $user = id(new PhabricatorPeopleQuery())
   ->setViewer(PhabricatorUser::getOmnipotentUser())
   ->withUsernames(array($username))
   ->executeOne();
 
 if (!$user) {
   throw new Exception(pht('No such user "%s"!', $username));
 }
 
 $engine->setViewer($user);
 
 
 // Read stdin for the hook engine.
 
 if ($repository->isHg()) {
   // Mercurial leaves stdin open, so we can't just read it until EOF.
   $stdin = '';
 } else {
   // Git and Subversion write data into stdin and then close it. Read the
   // data.
   $stdin = @file_get_contents('php://stdin');
   if ($stdin === false) {
     throw new Exception(pht('Failed to read stdin!'));
   }
 }
 
 $engine->setStdin($stdin);
 
 $remote_address = getenv(DiffusionCommitHookEngine::ENV_REMOTE_ADDRESS);
 if (strlen($remote_address)) {
   $engine->setRemoteAddress($remote_address);
 }
 
 $remote_protocol = getenv(DiffusionCommitHookEngine::ENV_REMOTE_PROTOCOL);
 if (strlen($remote_protocol)) {
   $engine->setRemoteProtocol($remote_protocol);
 }
 
 try {
   $err = $engine->execute();
 } catch (DiffusionCommitHookRejectException $ex) {
   $console = PhutilConsole::getConsole();
 
   if (PhabricatorEnv::getEnvConfig('phabricator.serious-business')) {
     $preamble = pht('*** PUSH REJECTED BY COMMIT HOOK ***');
   } else {
     $preamble = pht(<<<EOTXT
 +---------------------------------------------------------------+
 |      * * * PUSH REJECTED BY EVIL DRAGON BUREAUCRATS * * *     |
 +---------------------------------------------------------------+
             \
              \                    ^    /^
               \                  / \  // \
                \   |\___/|      /   \//  .\
                 \  /V  V  \__  /    //  | \ \           *----*
                   /     /  \/_/    //   |  \  \          \   |
                   @___@`    \/_   //    |   \   \         \/\ \
                  0/0/|       \/_ //     |    \    \         \  \
              0/0/0/0/|        \///      |     \     \       |  |
           0/0/0/0/0/_|_ /   (  //       |      \     _\     |  /
        0/0/0/0/0/0/`/,_ _ _/  ) ; -.    |    _ _\.-~       /   /
                    ,-}        _      *-.|.-~-.           .~    ~
   \     \__/        `/\      /                 ~-. _ .-~      /
    \____(Oo)           *.   }            {                   /
    (    (--)          .----~-.\        \-`                 .~
    //__\\\\  \ DENIED!  ///.----..<        \             _ -~
   //    \\\\               ///-._ _ _ _ _ _ _{^ - - - - ~
 
 EOTXT
 );
   }
 
   $console->writeErr("%s\n\n", $preamble);
   $console->writeErr("%s\n\n", $ex->getMessage());
   $err = 1;
 }
 
 exit($err);
diff --git a/src/applications/diffusion/engine/DiffusionCommitHookEngine.php b/src/applications/diffusion/engine/DiffusionCommitHookEngine.php
index 4f1b80534c..c75c2b1866 100644
--- a/src/applications/diffusion/engine/DiffusionCommitHookEngine.php
+++ b/src/applications/diffusion/engine/DiffusionCommitHookEngine.php
@@ -1,668 +1,771 @@
 <?php
 
 /**
  * @task config   Configuring the Hook Engine
  * @task hook     Hook Execution
  * @task git      Git Hooks
  * @task hg       Mercurial Hooks
  * @task svn      Subversion Hooks
  * @task internal Internals
  */
 final class DiffusionCommitHookEngine extends Phobject {
 
   const ENV_USER = 'PHABRICATOR_USER';
   const ENV_REMOTE_ADDRESS = 'PHABRICATOR_REMOTE_ADDRESS';
   const ENV_REMOTE_PROTOCOL = 'PHABRICATOR_REMOTE_PROTOCOL';
 
   const EMPTY_HASH = '0000000000000000000000000000000000000000';
 
   private $viewer;
   private $repository;
   private $stdin;
   private $subversionTransaction;
   private $subversionRepository;
   private $remoteAddress;
   private $remoteProtocol;
   private $transactionKey;
+  private $mercurialHook;
 
 
 /* -(  Config  )------------------------------------------------------------- */
 
 
   public function setRemoteProtocol($remote_protocol) {
     $this->remoteProtocol = $remote_protocol;
     return $this;
   }
 
   public function getRemoteProtocol() {
     return $this->remoteProtocol;
   }
 
   public function setRemoteAddress($remote_address) {
     $this->remoteAddress = $remote_address;
     return $this;
   }
 
   public function getRemoteAddress() {
     return $this->remoteAddress;
   }
 
   private function getRemoteAddressForLog() {
     // If whatever we have here isn't a valid IPv4 address, just store `null`.
     // Older versions of PHP return `-1` on failure instead of `false`.
     $remote_address = $this->getRemoteAddress();
     $remote_address = max(0, ip2long($remote_address));
     $remote_address = nonempty($remote_address, null);
     return $remote_address;
   }
 
   private function getTransactionKey() {
     if (!$this->transactionKey) {
       $entropy = Filesystem::readRandomBytes(64);
       $this->transactionKey = PhabricatorHash::digestForIndex($entropy);
     }
     return $this->transactionKey;
   }
 
   public function setSubversionTransactionInfo($transaction, $repository) {
     $this->subversionTransaction = $transaction;
     $this->subversionRepository = $repository;
     return $this;
   }
 
   public function setStdin($stdin) {
     $this->stdin = $stdin;
     return $this;
   }
 
   public function getStdin() {
     return $this->stdin;
   }
 
   public function setRepository(PhabricatorRepository $repository) {
     $this->repository = $repository;
     return $this;
   }
 
   public function getRepository() {
     return $this->repository;
   }
 
   public function setViewer(PhabricatorUser $viewer) {
     $this->viewer = $viewer;
     return $this;
   }
 
   public function getViewer() {
     return $this->viewer;
   }
 
+  public function setMercurialHook($mercurial_hook) {
+    $this->mercurialHook = $mercurial_hook;
+    return $this;
+  }
+
+  public function getMercurialHook() {
+    return $this->mercurialHook;
+  }
+
 
 /* -(  Hook Execution  )----------------------------------------------------- */
 
 
   public function execute() {
     $ref_updates = $this->findRefUpdates();
     $all_updates = $ref_updates;
 
     $caught = null;
     try {
 
       try {
         $this->rejectDangerousChanges($ref_updates);
       } catch (DiffusionCommitHookRejectException $ex) {
         // If we're rejecting dangerous changes, flag everything that we've
         // seen as rejected so it's clear that none of it was accepted.
         foreach ($all_updates as $update) {
           $update->setRejectCode(
             PhabricatorRepositoryPushLog::REJECT_DANGEROUS);
         }
         throw $ex;
       }
 
       // TODO: Fire ref herald rules.
 
       $content_updates = $this->findContentUpdates($ref_updates);
       $all_updates = array_merge($all_updates, $content_updates);
 
       // TODO: Fire content Herald rules.
       // TODO: Fire external hooks.
 
       // If we make it this far, we're accepting these changes. Mark all the
       // logs as accepted.
       foreach ($all_updates as $update) {
         $update->setRejectCode(PhabricatorRepositoryPushLog::REJECT_ACCEPT);
       }
     } catch (Exception $ex) {
       // We'll throw this again in a minute, but we want to save all the logs
       // first.
       $caught = $ex;
     }
 
     // Save all the logs no matter what the outcome was.
     foreach ($all_updates as $update) {
       $update->save();
     }
 
     if ($caught) {
       throw $caught;
     }
 
     return 0;
   }
 
   private function findRefUpdates() {
     $type = $this->getRepository()->getVersionControlSystem();
     switch ($type) {
       case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
         return $this->findGitRefUpdates();
       case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
         return $this->findMercurialRefUpdates();
       case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
         return $this->findSubversionRefUpdates();
       default:
         throw new Exception(pht('Unsupported repository type "%s"!', $type));
     }
   }
 
   private function rejectDangerousChanges(array $ref_updates) {
     assert_instances_of($ref_updates, 'PhabricatorRepositoryPushLog');
 
     $repository = $this->getRepository();
     if ($repository->shouldAllowDangerousChanges()) {
       return;
     }
 
     $flag_dangerous = PhabricatorRepositoryPushLog::CHANGEFLAG_DANGEROUS;
 
     foreach ($ref_updates as $ref_update) {
       if (!$ref_update->hasChangeFlags($flag_dangerous)) {
         // This is not a dangerous change.
         continue;
       }
 
       // We either have a branch deletion or a non fast-forward branch update.
       // Format a message and reject the push.
 
       $message = pht(
         "DANGEROUS CHANGE: %s\n".
         "Dangerous change protection is enabled for this repository.\n".
         "Edit the repository configuration before making dangerous changes.",
         $ref_update->getDangerousChangeDescription());
 
       throw new DiffusionCommitHookRejectException($message);
     }
   }
 
   private function findContentUpdates(array $ref_updates) {
     assert_instances_of($ref_updates, 'PhabricatorRepositoryPushLog');
 
     $type = $this->getRepository()->getVersionControlSystem();
     switch ($type) {
       case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
         return $this->findGitContentUpdates($ref_updates);
       case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
         return $this->findMercurialContentUpdates($ref_updates);
       case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
         return $this->findSubversionContentUpdates($ref_updates);
       default:
         throw new Exception(pht('Unsupported repository type "%s"!', $type));
     }
   }
 
 
 /* -(  Git  )---------------------------------------------------------------- */
 
 
   private function findGitRefUpdates() {
     $ref_updates = array();
 
     // First, parse stdin, which lists all the ref changes. The input looks
     // like this:
     //
     //   <old hash> <new hash> <ref>
 
     $stdin = $this->getStdin();
     $lines = phutil_split_lines($stdin, $retain_endings = false);
     foreach ($lines as $line) {
       $parts = explode(' ', $line, 3);
       if (count($parts) != 3) {
         throw new Exception(pht('Expected "old new ref", got "%s".', $line));
       }
 
       $ref_old = $parts[0];
       $ref_new = $parts[1];
       $ref_raw = $parts[2];
 
       if (preg_match('(^refs/heads/)', $ref_raw)) {
         $ref_type = PhabricatorRepositoryPushLog::REFTYPE_BRANCH;
       } else if (preg_match('(^refs/tags/)', $ref_raw)) {
         $ref_type = PhabricatorRepositoryPushLog::REFTYPE_TAG;
       } else {
-        $ref_type = PhabricatorRepositoryPushLog::REFTYPE_UNKNOWN;
+        throw new Exception(
+          pht(
+            "Unable to identify the reftype of '%s'. Rejecting push.",
+            $ref_raw));
       }
 
       $ref_update = $this->newPushLog()
         ->setRefType($ref_type)
         ->setRefName($ref_raw)
         ->setRefOld($ref_old)
         ->setRefNew($ref_new);
 
       $ref_updates[] = $ref_update;
     }
 
     $this->findGitMergeBases($ref_updates);
     $this->findGitChangeFlags($ref_updates);
 
     return $ref_updates;
   }
 
 
   private function findGitMergeBases(array $ref_updates) {
     assert_instances_of($ref_updates, 'PhabricatorRepositoryPushLog');
 
     $futures = array();
     foreach ($ref_updates as $key => $ref_update) {
       // If the old hash is "00000...", the ref is being created (either a new
       // branch, or a new tag). If the new hash is "00000...", the ref is being
       // deleted. If both are nonempty, the ref is being updated. For updates,
       // we'll figure out the `merge-base` of the old and new objects here. This
       // lets us reject non-FF changes cheaply; later, we'll figure out exactly
       // which commits are new.
       $ref_old = $ref_update->getRefOld();
       $ref_new = $ref_update->getRefNew();
 
       if (($ref_old === self::EMPTY_HASH) ||
           ($ref_new === self::EMPTY_HASH)) {
         continue;
       }
 
       $futures[$key] = $this->getRepository()->getLocalCommandFuture(
         'merge-base %s %s',
         $ref_old,
         $ref_new);
     }
 
     foreach (Futures($futures)->limit(8) as $key => $future) {
 
       // If 'old' and 'new' have no common ancestors (for example, a force push
       // which completely rewrites a ref), `git merge-base` will exit with
       // an error and no output. It would be nice to find a positive test
       // for this instead, but I couldn't immediately come up with one. See
       // T4224. Assume this means there are no ancestors.
 
       list($err, $stdout) = $future->resolve();
 
       if ($err) {
         $merge_base = null;
       } else {
         $merge_base = rtrim($stdout, "\n");
       }
 
       $ref_update->setMergeBase($merge_base);
     }
 
     return $ref_updates;
   }
 
 
   private function findGitChangeFlags(array $ref_updates) {
     assert_instances_of($ref_updates, 'PhabricatorRepositoryPushLog');
 
     foreach ($ref_updates as $key => $ref_update) {
       $ref_old = $ref_update->getRefOld();
       $ref_new = $ref_update->getRefNew();
       $ref_type = $ref_update->getRefType();
 
       $ref_flags = 0;
       $dangerous = null;
 
       if ($ref_old === self::EMPTY_HASH) {
         $ref_flags |= PhabricatorRepositoryPushLog::CHANGEFLAG_ADD;
       } else if ($ref_new === self::EMPTY_HASH) {
         $ref_flags |= PhabricatorRepositoryPushLog::CHANGEFLAG_DELETE;
         if ($ref_type == PhabricatorRepositoryPushLog::REFTYPE_BRANCH) {
           $ref_flags |= PhabricatorRepositoryPushLog::CHANGEFLAG_DANGEROUS;
           $dangerous = pht(
             "The change you're attempting to push deletes the branch '%s'.",
             $ref_update->getRefName());
         }
       } else {
         $merge_base = $ref_update->getMergeBase();
         if ($merge_base == $ref_old) {
           // This is a fast-forward update to an existing branch.
           // These are safe.
           $ref_flags |= PhabricatorRepositoryPushLog::CHANGEFLAG_APPEND;
         } else {
           $ref_flags |= PhabricatorRepositoryPushLog::CHANGEFLAG_REWRITE;
 
           // For now, we don't consider deleting or moving tags to be a
           // "dangerous" update. It's way harder to get wrong and should be easy
           // to recover from once we have better logging. Only add the dangerous
           // flag if this ref is a branch.
 
           if ($ref_type == PhabricatorRepositoryPushLog::REFTYPE_BRANCH) {
             $ref_flags |= PhabricatorRepositoryPushLog::CHANGEFLAG_DANGEROUS;
 
             $dangerous = pht(
               "The change you're attempting to push updates the branch '%s' ".
               "from '%s' to '%s', but this is not a fast-forward. Pushes ".
               "which rewrite published branch history are dangerous.",
               $ref_update->getRefName(),
               $ref_update->getRefOldShort(),
               $ref_update->getRefNewShort());
           }
         }
       }
 
       $ref_update->setChangeFlags($ref_flags);
       if ($dangerous !== null) {
         $ref_update->attachDangerousChangeDescription($dangerous);
       }
     }
 
     return $ref_updates;
   }
 
 
   private function findGitContentUpdates(array $ref_updates) {
     $flag_delete = PhabricatorRepositoryPushLog::CHANGEFLAG_DELETE;
 
     $futures = array();
     foreach ($ref_updates as $key => $ref_update) {
       if ($ref_update->hasChangeFlags($flag_delete)) {
         // Deleting a branch or tag can never create any new commits.
         continue;
       }
 
       // NOTE: This piece of magic finds all new commits, by walking backward
       // from the new value to the value of *any* existing ref in the
       // repository. Particularly, this will cover the cases of a new branch, a
       // completely moved tag, etc.
       $futures[$key] = $this->getRepository()->getLocalCommandFuture(
         'log --format=%s %s --not --all',
         '%H',
         $ref_update->getRefNew());
     }
 
     $content_updates = array();
     foreach (Futures($futures)->limit(8) as $key => $future) {
       list($stdout) = $future->resolvex();
 
       if (!strlen(trim($stdout))) {
         // This change doesn't have any new commits. One common case of this
         // is creating a new tag which points at an existing commit.
         continue;
       }
 
       $commits = phutil_split_lines($stdout, $retain_newlines = false);
 
       foreach ($commits as $commit) {
         $content_updates[$commit] = $this->newPushLog()
           ->setRefType(PhabricatorRepositoryPushLog::REFTYPE_COMMIT)
           ->setRefNew($commit)
           ->setChangeFlags(PhabricatorRepositoryPushLog::CHANGEFLAG_ADD);
       }
     }
 
     return $content_updates;
   }
 
 
 /* -(  Mercurial  )---------------------------------------------------------- */
 
 
   private function findMercurialRefUpdates() {
+    $hook = $this->getMercurialHook();
+    switch ($hook) {
+      case 'pretxnchangegroup':
+        return $this->findMercurialChangegroupRefUpdates();
+      case 'prepushkey':
+        return $this->findMercurialPushKeyRefUpdates();
+      case 'pretag':
+        return $this->findMercurialPreTagRefUpdates();
+      default:
+        throw new Exception(pht('Unrecognized hook "%s"!', $hook));
+    }
+  }
+
+  private function findMercurialChangegroupRefUpdates() {
     $hg_node = getenv('HG_NODE');
     if (!$hg_node) {
       throw new Exception(pht('Expected HG_NODE in environment!'));
     }
 
     // NOTE: We need to make sure this is passed to subprocesses, or they won't
     // be able to see new commits. Mercurial uses this as a marker to determine
     // whether the pending changes are visible or not.
     $_ENV['HG_PENDING'] = getenv('HG_PENDING');
     $repository = $this->getRepository();
 
     $futures = array();
 
     foreach (array('old', 'new') as $key) {
       $futures[$key] = $repository->getLocalCommandFuture(
         'heads --template %s',
         '{node}\1{branches}\2');
     }
     // Wipe HG_PENDING out of the old environment so we see the pre-commit
     // state of the repository.
     $futures['old']->updateEnv('HG_PENDING', null);
 
     $futures['commits'] = $repository->getLocalCommandFuture(
       "log --rev %s --rev tip --template %s",
       hgsprintf('%s', $hg_node),
       '{node}\1{branches}\2');
 
     // Resolve all of the futures now. We don't need the 'commits' future yet,
     // but it simplifies the logic to just get it out of the way.
     foreach (Futures($futures) as $future) {
       $future->resolvex();
     }
 
     list($commit_raw) = $futures['commits']->resolvex();
     $commit_map = $this->parseMercurialCommits($commit_raw);
 
     list($old_raw) = $futures['old']->resolvex();
     $old_refs = $this->parseMercurialHeads($old_raw);
 
     list($new_raw) = $futures['new']->resolvex();
     $new_refs = $this->parseMercurialHeads($new_raw);
 
     $all_refs = array_keys($old_refs + $new_refs);
 
     $ref_updates = array();
     foreach ($all_refs as $ref) {
       $old_heads = idx($old_refs, $ref, array());
       $new_heads = idx($new_refs, $ref, array());
 
       sort($old_heads);
       sort($new_heads);
 
       if ($old_heads === $new_heads) {
         // No changes to this branch, so skip it.
         continue;
       }
 
       if (!$new_heads) {
         if ($old_heads) {
           // It looks like this push deletes a branch, but that isn't possible
           // in Mercurial, so something is going wrong here. Bail out.
           throw new Exception(
             pht(
               'Mercurial repository has no new head for branch "%s" after '.
               'push. This is unexpected; rejecting change.'));
         } else {
           // Obviously, this should never be possible either, as it makes
           // no sense. Explode.
           throw new Exception(
             pht(
               'Mercurial repository has no new or old heads for branch "%s" '.
               'after push. This makes no sense; rejecting change.'));
         }
       }
 
       $stray_heads = array();
       if (count($old_heads) > 1) {
         // HORRIBLE: In Mercurial, branches can have multiple heads. If the
         // old branch had multiple heads, we need to figure out which new
         // heads descend from which old heads, so we can tell whether you're
         // actively creating new heads (dangerous) or just working in a
         // repository that's already full of garbage (strongly discouraged but
         // not as inherently dangerous). These cases should be very uncommon.
 
         $dfutures = array();
         foreach ($old_heads as $old_head) {
           $dfutures[$old_head] = $repository->getLocalCommandFuture(
             'log --rev %s --template %s',
             hgsprintf('(descendants(%s) and head())', $old_head),
             '{node}\1');
         }
 
         $head_map = array();
         foreach (Futures($dfutures) as $future_head => $dfuture) {
           list($stdout) = $dfuture->resolvex();
           $head_map[$future_head] = array_filter(explode("\1", $stdout));
         }
 
         // Now, find all the new stray heads this push creates, if any. These
         // are new heads which do not descend from the old heads.
         $seen = array_fuse(array_mergev($head_map));
         foreach ($new_heads as $new_head) {
           if (empty($seen[$new_head])) {
             $head_map[self::EMPTY_HASH][] = $new_head;
           }
         }
       } else if ($old_heads) {
         $head_map[head($old_heads)] = $new_heads;
       } else {
         $head_map[self::EMPTY_HASH] = $new_heads;
       }
 
       foreach ($head_map as $old_head => $child_heads) {
         foreach ($child_heads as $new_head) {
           if ($new_head === $old_head) {
             continue;
           }
 
           $ref_flags = 0;
           $dangerous = null;
           if ($old_head == self::EMPTY_HASH) {
             $ref_flags |= PhabricatorRepositoryPushLog::CHANGEFLAG_ADD;
           } else {
             $ref_flags |= PhabricatorRepositoryPushLog::CHANGEFLAG_APPEND;
           }
 
           $splits_existing_head = (count($child_heads) > 1);
           $creates_duplicate_head = ($old_head == self::EMPTY_HASH) &&
                                     (count($head_map) > 1);
 
           if ($splits_existing_head || $creates_duplicate_head) {
             $readable_child_heads = array();
             foreach ($child_heads as $child_head) {
               $readable_child_heads[] = substr($child_head, 0, 12);
             }
 
             $ref_flags |= PhabricatorRepositoryPushLog::CHANGEFLAG_DANGEROUS;
 
             if ($splits_existing_head) {
               // We're splitting an existing head into two or more heads.
               // This is dangerous, and a super bad idea. Note that we're only
               // raising this if you're actively splitting a branch head. If a
               // head split in the past, we don't consider appends to it
               // to be dangerous.
               $dangerous = pht(
                 "The change you're attempting to push splits the head of ".
                 "branch '%s' into multiple heads: %s. This is inadvisable ".
                 "and dangerous.",
                 $ref,
                 implode(', ', $readable_child_heads));
             } else {
               // We're adding a second (or more) head to a branch. The new
               // head is not a descendant of any old head.
               $dangerous = pht(
                 "The change you're attempting to push creates new, divergent ".
                 "heads for the branch '%s': %s. This is inadvisable and ".
                 "dangerous.",
                 $ref,
                 implode(', ', $readable_child_heads));
             }
           }
 
           $ref_update = $this->newPushLog()
             ->setRefType(PhabricatorRepositoryPushLog::REFTYPE_BRANCH)
             ->setRefName($ref)
             ->setRefOld($old_head)
             ->setRefNew($new_head)
             ->setChangeFlags($ref_flags);
 
           if ($dangerous !== null) {
             $ref_update->attachDangerousChangeDescription($dangerous);
           }
 
           $ref_updates[] = $ref_update;
         }
       }
     }
 
     return $ref_updates;
   }
 
+  private function findMercurialPushKeyRefUpdates() {
+    $key_namespace = getenv('HG_NAMESPACE');
+
+    if ($key_namespace === 'phases') {
+      // Mercurial changes commit phases as part of normal push operations. We
+      // just ignore these, as they don't seem to represent anything
+      // interesting.
+      return array();
+    }
+
+    $key_name = getenv('HG_KEY');
+
+    $key_old = getenv('HG_OLD');
+    if (!strlen($key_old)) {
+      $key_old = null;
+    }
+
+    $key_new = getenv('HG_NEW');
+    if (!strlen($key_new)) {
+      $key_new = null;
+    }
+
+    if ($key_namespace !== 'bookmarks') {
+      throw new Exception(
+        pht(
+          "Unknown Mercurial key namespace '%s', with key '%s' (%s -> %s). ".
+          "Rejecting push.",
+          $key_namespace,
+          $key_name,
+          coalesce($key_old, pht('null')),
+          coalesce($key_new, pht('null'))));
+    }
+
+    if ($key_old === $key_new) {
+      // We get a callback when the bookmark doesn't change. Just ignore this,
+      // as it's a no-op.
+      return array();
+    }
+
+    $ref_flags = 0;
+    $merge_base = null;
+    if ($key_old === null) {
+      $ref_flags |= PhabricatorRepositoryPushLog::CHANGEFLAG_ADD;
+    } else if ($key_new === null) {
+      $ref_flags |= PhabricatorRepositoryPushLog::CHANGEFLAG_DELETE;
+    } else {
+      list($merge_base_raw) = $this->getRepository()->execxLocalCommand(
+        'log --template %s --rev %s',
+        '{node}',
+        hgsprintf('ancestor(%s, %s)', $key_old, $key_new));
+
+      if (strlen(trim($merge_base_raw))) {
+        $merge_base = trim($merge_base_raw);
+      }
+
+      if ($merge_base && ($merge_base === $key_old)) {
+        $ref_flags |= PhabricatorRepositoryPushLog::CHANGEFLAG_APPEND;
+      } else {
+        $ref_flags |= PhabricatorRepositoryPushLog::CHANGEFLAG_REWRITE;
+      }
+    }
+
+    $ref_update = $this->newPushLog()
+      ->setRefType(PhabricatorRepositoryPushLog::REFTYPE_BOOKMARK)
+      ->setRefName($key_name)
+      ->setRefOld(coalesce($key_old, self::EMPTY_HASH))
+      ->setRefNew(coalesce($key_new, self::EMPTY_HASH))
+      ->setChangeFlags($ref_flags);
+
+    return array($ref_update);
+  }
+
+  private function findMercurialPreTagRefUpdates() {
+    return array();
+  }
+
+  private function findMercurialContentUpdates(array $ref_updates) {
+    // TODO: Implement.
+    return array();
+  }
+
   private function parseMercurialCommits($raw) {
     $commits_lines = explode("\2", $raw);
     $commits_lines = array_filter($commits_lines);
     $commit_map = array();
     foreach ($commits_lines as $commit_line) {
       list($node, $branches_raw) = explode("\1", $commit_line);
 
       if (!strlen($branches_raw)) {
         $branches = array('default');
       } else {
         $branches = explode(' ', $branches_raw);
       }
 
       $commit_map[$node] = $branches;
     }
 
     return $commit_map;
   }
 
   private function parseMercurialHeads($raw) {
     $heads_map = $this->parseMercurialCommits($raw);
 
     $heads = array();
     foreach ($heads_map as $commit => $branches) {
       foreach ($branches as $branch) {
         $heads[$branch][] = $commit;
       }
     }
 
     return $heads;
   }
 
-  private function findMercurialContentUpdates(array $ref_updates) {
-    // TODO: Implement.
-    return array();
-  }
-
 
 /* -(  Subversion  )--------------------------------------------------------- */
 
 
   private function findSubversionRefUpdates() {
     // TODO: Implement.
     return array();
   }
 
   private function findSubversionContentUpdates(array $ref_updates) {
     // TODO: Implement.
     return array();
   }
 
 
 /* -(  Internals  )---------------------------------------------------------- */
 
 
   private function newPushLog() {
     // NOTE: By default, we create these with REJECT_BROKEN as the reject
     // code. This indicates a broken hook, and covers the case where we
     // encounter some unexpected exception and consequently reject the changes.
 
     return PhabricatorRepositoryPushLog::initializeNewLog($this->getViewer())
       ->attachRepository($this->getRepository())
       ->setRepositoryPHID($this->getRepository()->getPHID())
       ->setEpoch(time())
       ->setRemoteAddress($this->getRemoteAddressForLog())
       ->setRemoteProtocol($this->getRemoteProtocol())
       ->setTransactionKey($this->getTransactionKey())
       ->setRejectCode(PhabricatorRepositoryPushLog::REJECT_BROKEN)
       ->setRejectDetails(null);
   }
 
 }
diff --git a/src/applications/repository/engine/PhabricatorRepositoryPullEngine.php b/src/applications/repository/engine/PhabricatorRepositoryPullEngine.php
index d575fb2e0a..59be2016fd 100644
--- a/src/applications/repository/engine/PhabricatorRepositoryPullEngine.php
+++ b/src/applications/repository/engine/PhabricatorRepositoryPullEngine.php
@@ -1,439 +1,455 @@
 <?php
 
 /**
  * Manages execution of `git pull` and `hg pull` commands for
  * @{class:PhabricatorRepository} objects. Used by
  * @{class:PhabricatorRepositoryPullLocalDaemon}.
  *
  * This class also covers initial working copy setup through `git clone`,
  * `git init`, `hg clone`, `hg init`, or `svnadmin create`.
  *
  * @task pull     Pulling Working Copies
  * @task git      Pulling Git Working Copies
  * @task hg       Pulling Mercurial Working Copies
  * @task svn      Pulling Subversion Working Copies
  * @task internal Internals
  */
 final class PhabricatorRepositoryPullEngine
   extends PhabricatorRepositoryEngine {
 
 
 /* -(  Pulling Working Copies  )--------------------------------------------- */
 
 
   public function pullRepository() {
     $repository = $this->getRepository();
 
     $is_hg = false;
     $is_git = false;
     $is_svn = false;
 
     $vcs = $repository->getVersionControlSystem();
     $callsign = $repository->getCallsign();
 
     switch ($vcs) {
       case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
         // We never pull a local copy of non-hosted Subversion repositories.
         if (!$repository->isHosted()) {
           $this->skipPull(
             pht(
               "Repository '%s' is a non-hosted Subversion repository, which ".
               "does not require a local working copy to be pulled.",
               $callsign));
           return;
         }
         $is_svn = true;
         break;
       case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
         $is_git = true;
         break;
       case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
         $is_hg = true;
         break;
       default:
         $this->abortPull(pht('Unknown VCS "%s"!', $vcs));
     }
 
     $callsign = $repository->getCallsign();
     $local_path = $repository->getLocalPath();
     if ($local_path === null) {
       $this->abortPull(
         pht(
           "No local path is configured for repository '%s'.",
           $callsign));
     }
 
     try {
       $dirname = dirname($local_path);
       if (!Filesystem::pathExists($dirname)) {
         Filesystem::createDirectory($dirname, 0755, $recursive = true);
       }
 
       if (!Filesystem::pathExists($local_path)) {
         $this->logPull(
           pht(
             "Creating a new working copy for repository '%s'.",
             $callsign));
         if ($is_git) {
           $this->executeGitCreate();
         } else if ($is_hg) {
           $this->executeMercurialCreate();
         } else {
           $this->executeSubversionCreate();
         }
       } else {
         if ($repository->isHosted()) {
           if ($is_git) {
             $this->installGitHook();
           } else if ($is_svn) {
             $this->installSubversionHook();
           } else if ($is_hg) {
             $this->installMercurialHook();
           } else {
             $this->logPull(
               pht(
                 "Repository '%s' is hosted, so Phabricator does not pull ".
                 "updates for it.",
                 $callsign));
           }
         } else {
           $this->logPull(
             pht(
               "Updating the working copy for repository '%s'.",
               $callsign));
           if ($is_git) {
             $this->executeGitUpdate();
           } else {
             $this->executeMercurialUpdate();
           }
         }
       }
     } catch (Exception $ex) {
       $this->abortPull(
         pht('Pull of "%s" failed: %s', $callsign, $ex->getMessage()),
         $ex);
     }
 
     $this->donePull();
 
     return $this;
   }
 
   private function skipPull($message) {
     $this->log('%s', $message);
     $this->donePull();
   }
 
   private function abortPull($message, Exception $ex = null) {
     $code_error = PhabricatorRepositoryStatusMessage::CODE_ERROR;
     $this->updateRepositoryInitStatus($code_error, $message);
     if ($ex) {
       throw $ex;
     } else {
       throw new Exception($message);
     }
   }
 
   private function logPull($message) {
     $code_working = PhabricatorRepositoryStatusMessage::CODE_WORKING;
     $this->updateRepositoryInitStatus($code_working, $message);
     $this->log('%s', $message);
   }
 
   private function donePull() {
     $code_okay = PhabricatorRepositoryStatusMessage::CODE_OKAY;
     $this->updateRepositoryInitStatus($code_okay);
   }
 
   private function updateRepositoryInitStatus($code, $message = null) {
     $this->getRepository()->writeStatusMessage(
       PhabricatorRepositoryStatusMessage::TYPE_INIT,
       $code,
       array(
         'message' => $message
       ));
   }
 
   private function installHook($path) {
     $this->log('%s', pht('Installing commit hook to "%s"...', $path));
 
     $repository = $this->getRepository();
     $callsign = $repository->getCallsign();
 
     $root = dirname(phutil_get_library_root('phabricator'));
     $bin = $root.'/bin/commit-hook';
     $cmd = csprintf('exec %s %s "$@"', $bin, $callsign);
 
     $hook = "#!/bin/sh\n{$cmd}\n";
 
     Filesystem::writeFile($path, $hook);
     Filesystem::changePermissions($path, 0755);
   }
 
 
 /* -(  Pulling Git Working Copies  )----------------------------------------- */
 
 
   /**
    * @task git
    */
   private function executeGitCreate() {
     $repository = $this->getRepository();
 
     $path = rtrim($repository->getLocalPath(), '/');
 
     if ($repository->isHosted()) {
       $repository->execxRemoteCommand(
         'init --bare -- %s',
         $path);
     } else {
       $repository->execxRemoteCommand(
         'clone --bare -- %P %s',
         $repository->getRemoteURIEnvelope(),
         $path);
     }
   }
 
 
   /**
    * @task git
    */
   private function executeGitUpdate() {
     $repository = $this->getRepository();
 
     list($err, $stdout) = $repository->execLocalCommand(
       'rev-parse --show-toplevel');
 
     $message = null;
     $path = $repository->getLocalPath();
     if ($err) {
       // Try to raise a more tailored error message in the more common case
       // of the user creating an empty directory. (We could try to remove it,
       // but might not be able to, and it's much simpler to raise a good
       // message than try to navigate those waters.)
       if (is_dir($path)) {
         $files = Filesystem::listDirectory($path, $include_hidden = true);
         if (!$files) {
           $message =
             "Expected to find a git repository at '{$path}', but there ".
             "is an empty directory there. Remove the directory: the daemon ".
             "will run 'git clone' for you.";
         } else {
           $message =
             "Expected to find a git repository at '{$path}', but there is ".
             "a non-repository directory (with other stuff in it) there. Move ".
             "or remove this directory (or reconfigure the repository to use a ".
             "different directory), and then either clone a repository ".
             "yourself or let the daemon do it.";
         }
       } else if (is_file($path)) {
         $message =
           "Expected to find a git repository at '{$path}', but there is a ".
           "file there instead. Remove it and let the daemon clone a ".
           "repository for you.";
       } else {
         $message =
           "Expected to find a git repository at '{$path}', but did not.";
       }
     } else {
       $repo_path = rtrim($stdout, "\n");
 
       if (empty($repo_path)) {
         // This can mean one of two things: we're in a bare repository, or
         // we're inside a git repository inside another git repository. Since
         // the first is dramatically more likely now that we perform bare
         // clones and I don't have a great way to test for the latter, assume
         // we're OK.
       } else if (!Filesystem::pathsAreEquivalent($repo_path, $path)) {
         $err = true;
         $message =
           "Expected to find repo at '{$path}', but the actual ".
           "git repository root for this directory is '{$repo_path}'. ".
           "Something is misconfigured. The repository's 'Local Path' should ".
           "be set to some place where the daemon can check out a working ".
           "copy, and should not be inside another git repository.";
       }
     }
 
     if ($err && $repository->canDestroyWorkingCopy()) {
       phlog("Repository working copy at '{$path}' failed sanity check; ".
             "destroying and re-cloning. {$message}");
       Filesystem::remove($path);
       $this->executeGitCreate();
     } else if ($err) {
       throw new Exception($message);
     }
 
     $retry = false;
     do {
       // This is a local command, but needs credentials.
       if ($repository->isWorkingCopyBare()) {
         // For bare working copies, we need this magic incantation.
         $future = $repository->getRemoteCommandFuture(
           'fetch origin %s --prune',
           '+refs/heads/*:refs/heads/*');
       } else {
         $future = $repository->getRemoteCommandFuture(
           'fetch --all --prune');
       }
 
       $future->setCWD($path);
       list($err, $stdout, $stderr) = $future->resolve();
 
       if ($err && !$retry && $repository->canDestroyWorkingCopy()) {
         $retry = true;
         // Fix remote origin url if it doesn't match our configuration
         $origin_url = $repository->execLocalCommand(
           'config --get remote.origin.url');
         $remote_uri = $repository->getDetail('remote-uri');
         if ($origin_url != $remote_uri) {
           $repository->execLocalCommand(
             'remote set-url origin %s',
             $remote_uri);
         }
       } else if ($err) {
         throw new Exception(
           "git fetch failed with error #{$err}:\n".
           "stdout:{$stdout}\n\n".
           "stderr:{$stderr}\n");
       } else {
         $retry = false;
       }
     } while ($retry);
   }
 
 
   /**
    * @task git
    */
   private function installGitHook() {
     $repository = $this->getRepository();
     $path = $repository->getLocalPath();
 
     if ($repository->isWorkingCopyBare()) {
       $path .= '/hooks/pre-receive';
     } else {
       $path .= '/.git/hooks/pre-receive';
     }
 
     $this->installHook($path);
   }
 
 
 /* -(  Pulling Mercurial Working Copies  )----------------------------------- */
 
 
   /**
    * @task hg
    */
   private function executeMercurialCreate() {
     $repository = $this->getRepository();
 
     $path = rtrim($repository->getLocalPath(), '/');
 
     if ($repository->isHosted()) {
       $repository->execxRemoteCommand(
         'init -- %s',
         $path);
     } else {
       $repository->execxRemoteCommand(
         'clone --noupdate -- %P %s',
         $repository->getRemoteURIEnvelope(),
         $path);
     }
   }
 
 
   /**
    * @task hg
    */
   private function executeMercurialUpdate() {
     $repository = $this->getRepository();
     $path = $repository->getLocalPath();
 
     // This is a local command, but needs credentials.
     $future = $repository->getRemoteCommandFuture('pull -u');
     $future->setCWD($path);
 
     try {
       $future->resolvex();
     } catch (CommandException $ex) {
       $err = $ex->getError();
       $stdout = $ex->getStdOut();
 
       // NOTE: Between versions 2.1 and 2.1.1, Mercurial changed the behavior
       // of "hg pull" to return 1 in case of a successful pull with no changes.
       // This behavior has been reverted, but users who updated between Feb 1,
       // 2012 and Mar 1, 2012 will have the erroring version. Do a dumb test
       // against stdout to check for this possibility.
       // See: https://github.com/facebook/phabricator/issues/101/
 
       // NOTE: Mercurial has translated versions, which translate this error
       // string. In a translated version, the string will be something else,
       // like "aucun changement trouve". There didn't seem to be an easy way
       // to handle this (there are hard ways but this is not a common problem
       // and only creates log spam, not application failures). Assume English.
 
       // TODO: Remove this once we're far enough in the future that deployment
       // of 2.1 is exceedingly rare?
       if ($err == 1 && preg_match('/no changes found/', $stdout)) {
         return;
       } else {
         throw $ex;
       }
     }
   }
 
 
   /**
    * @task hg
    */
   private function installMercurialHook() {
     $repository = $this->getRepository();
     $path = $repository->getLocalPath().'/.hg/hgrc';
 
     $root = dirname(phutil_get_library_root('phabricator'));
     $bin = $root.'/bin/commit-hook';
 
     $data = array();
     $data[] = '[hooks]';
+
+    // This hook handles normal pushes.
     $data[] = csprintf(
       'pretxnchangegroup.phabricator = %s %s %s',
       $bin,
       $repository->getCallsign(),
       'pretxnchangegroup');
+
+    // This one handles creating bookmarks.
+    $data[] = csprintf(
+      'prepushkey.phabricator = %s %s %s',
+      $bin,
+      $repository->getCallsign(),
+      'prepushkey');
+
+    // This one handles creating tags.
+    $data[] = csprintf(
+      'pretag.phabricator = %s %s %s',
+      $bin,
+      $repository->getCallsign(),
+      'pretag');
     $data[] = null;
 
     $data = implode("\n", $data);
 
     $this->log('%s', pht('Installing commit hook config to "%s"...', $path));
 
     Filesystem::writeFile($path, $data);
   }
 
 
 /* -(  Pulling Subversion Working Copies  )---------------------------------- */
 
 
   /**
    * @task svn
    */
   private function executeSubversionCreate() {
     $repository = $this->getRepository();
 
     $path = rtrim($repository->getLocalPath(), '/');
     execx('svnadmin create -- %s', $path);
   }
 
   /**
    * @task svn
    */
   private function installSubversionHook() {
     $repository = $this->getRepository();
     $path = $repository->getLocalPath().'/hooks/pre-commit';
 
     $this->installHook($path);
   }
 
 
 }
diff --git a/src/applications/repository/storage/PhabricatorRepositoryPushLog.php b/src/applications/repository/storage/PhabricatorRepositoryPushLog.php
index b0d885bd99..107aefb934 100644
--- a/src/applications/repository/storage/PhabricatorRepositoryPushLog.php
+++ b/src/applications/repository/storage/PhabricatorRepositoryPushLog.php
@@ -1,143 +1,142 @@
 <?php
 
 /**
  * Records a push to a hosted repository. This allows us to store metadata
  * about who pushed commits, when, and from where. We can also record the
  * history of branches and tags, which is not normally persisted outside of
  * the reflog.
  *
  * This log is written by commit hooks installed into hosted repositories.
  * See @{class:DiffusionCommitHookEngine}.
  */
 final class PhabricatorRepositoryPushLog
   extends PhabricatorRepositoryDAO
   implements PhabricatorPolicyInterface {
 
   const REFTYPE_BRANCH = 'branch';
   const REFTYPE_TAG = 'tag';
   const REFTYPE_BOOKMARK = 'bookmark';
   const REFTYPE_SVN = 'svn';
   const REFTYPE_COMMIT = 'commit';
-  const REFTYPE_UNKNOWN = 'unknown';
 
   const CHANGEFLAG_ADD = 1;
   const CHANGEFLAG_DELETE = 2;
   const CHANGEFLAG_APPEND = 4;
   const CHANGEFLAG_REWRITE = 8;
   const CHANGEFLAG_DANGEROUS = 16;
 
   const REJECT_ACCEPT = 0;
   const REJECT_DANGEROUS = 1;
   const REJECT_HERALD = 2;
   const REJECT_EXTERNAL = 3;
   const REJECT_BROKEN = 4;
 
   protected $repositoryPHID;
   protected $epoch;
   protected $pusherPHID;
   protected $remoteAddress;
   protected $remoteProtocol;
   protected $transactionKey;
   protected $refType;
   protected $refNameHash;
   protected $refNameRaw;
   protected $refNameEncoding;
   protected $refOld;
   protected $refNew;
   protected $mergeBase;
   protected $changeFlags;
   protected $rejectCode;
   protected $rejectDetails;
 
   private $dangerousChangeDescription = self::ATTACHABLE;
   private $repository = self::ATTACHABLE;
 
   public static function initializeNewLog(PhabricatorUser $viewer) {
     return id(new PhabricatorRepositoryPushLog())
       ->setPusherPHID($viewer->getPHID());
   }
 
   public function getConfiguration() {
     return array(
       self::CONFIG_TIMESTAMPS => false,
     ) + parent::getConfiguration();
   }
 
   public function attachRepository(PhabricatorRepository $repository) {
     $this->repository = $repository;
     return $this;
   }
 
   public function getRepository() {
     return $this->assertAttached($this->repository);
   }
 
   public function getRefName() {
     if ($this->getRefNameEncoding() == 'utf8') {
       return $this->getRefNameRaw();
     }
     return phutil_utf8ize($this->getRefNameRaw());
   }
 
   public function setRefName($ref_raw) {
     $encoding = phutil_is_utf8($ref_raw) ? 'utf8' : null;
 
     $this->setRefNameRaw($ref_raw);
     $this->setRefNameHash(PhabricatorHash::digestForIndex($ref_raw));
     $this->setRefNameEncoding($encoding);
 
     return $this;
   }
 
   public function getRefOldShort() {
     if ($this->getRepository()->isSVN()) {
       return $this->getRefOld();
     }
     return substr($this->getRefOld(), 0, 12);
   }
 
   public function getRefNewShort() {
     if ($this->getRepository()->isSVN()) {
       return $this->getRefNew();
     }
     return substr($this->getRefNew(), 0, 12);
   }
 
   public function hasChangeFlags($mask) {
     return ($this->changeFlags & $mask);
   }
 
   public function attachDangerousChangeDescription($description) {
     $this->dangerousChangeDescription = $description;
     return $this;
   }
 
   public function getDangerousChangeDescription() {
     return $this->assertAttached($this->dangerousChangeDescription);
   }
 
 
 /* -(  PhabricatorPolicyInterface  )----------------------------------------- */
 
 
   public function getCapabilities() {
     return array(
       PhabricatorPolicyCapability::CAN_VIEW,
     );
   }
 
   public function getPolicy($capability) {
     return $this->getRepository()->getPolicy($capability);
   }
 
   public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
     return $this->getRepository()->hasAutomaticCapability($capability, $viewer);
   }
 
   public function describeAutomaticCapability($capability) {
     return pht(
       "A repository's push logs are visible to users who can see the ".
       "repository.");
   }
 
 }