diff --git a/contrib/VREF/gl-VREF-COUNT b/contrib/VREF/gl-VREF-COUNT
new file mode 100755
index 0000000..f61ab57
--- /dev/null
+++ b/contrib/VREF/gl-VREF-COUNT
@@ -0,0 +1,51 @@
+#!/bin/bash
+
+# gitolite VREF to count number of changed/new files in a push
+
+# see gitolite docs for what the first 7 arguments mean
+
+# inputs:
+#   arg-8 is a number
+#   arg-9 is optional, and can be "NEWFILES"
+# outputs (STDOUT)
+#   arg-7 if the number of changed (or new, if arg-9 supplied) files is > arg-8
+#   otherwise nothing
+# exit status:
+#   always 0
+
+die() { echo "$@" >&2; exit 1; }
+[ -z "$8" ] && die "not meant to be run manually"
+
+newsha=$3
+oldtree=$4
+newtree=$5
+refex=$7
+
+max=$8
+
+nf=
+[ "$9" = "NEWFILES" ] && nf='--diff-filter=A'
+# NO_SIGNOFF implies NEWFILES
+[ "$9" = "NO_SIGNOFF" ] && nf='--diff-filter=A'
+
+# count files against all the other commits in the system not just $oldsha
+# (why?  consider what is $oldtree when you create a new branch, or what is
+# $oldsha when you update an old feature branch from master and then push it
+count=`git log --name-only $nf --format=%n $newtree --not --all | grep . | sort -u | wc -l`
+
+[[ $count -gt $max ]] && {
+    # count has been exceeded.  If $9 was NO_SIGNOFF there's still a chance
+    # for redemption -- if the top commit has a proper signed-off by line
+    [ "$9" = "NO_SIGNOFF" ] && {
+        author_email=$(git log --format=%ae -1 $newsha)
+        git cat-file -p $newsha |
+            egrep -i >/dev/null "^ *$count +new +files +signed-off by: *$author_email *$" && exit 0
+        echo $refex top commit message should include the text \'$count new files signed-off by: $author_email\'
+        exit 0
+    }
+    echo -n $refex "(too many "
+    [ -n "$nf" ] && echo -n "new " || echo -n "changed "
+    echo "files in this push)"
+}
+
+exit 0
diff --git a/hooks/common/update b/hooks/common/update
index 1048208..f31f108 100755
--- a/hooks/common/update
+++ b/hooks/common/update
@@ -75,32 +75,12 @@ push @allowed_refs, @ { $repos{'@all'}       {$ENV{GL_USER}} || [] };
 push @allowed_refs, @ { $repos{$ENV{GL_REPO}}{'@all'} || [] };
 push @allowed_refs, @ { $repos{'@all'}       {'@all'} || [] };
 
-# prepare the list of refs to be checked
+# first check the main ref (this is a *real* ref, like refs/heads/master, and
+# is what we print in the log)
+my $log_refex = check_ref(\@allowed_refs, $ENV{GL_REPO}, $ref, $att_acc);
 
-# previously, we just checked $ref -- the ref being updated, which is passed
-# to us by git (see man githooks).  Now we also have to treat each NAME being
-# updated as a potential "ref" and check that, if NAME-based restrictions have
-# been specified
-
-my @refs = ($ref);      # the first ref to check is the real one
-# because making it work screws up efficiency like no tomorrow...
-if (exists $repos{$ENV{GL_REPO}}{NAME_LIMITS}) {
-    # this is special to git -- the hash of an empty tree
-    my $empty='4b825dc642cb6eb9a060e54bf8d69288fbee4904';
-    # well they're not really "trees" but $empty is indeed the empty tree so
-    # we can just pretend $oldsha/$newsha are also trees, and anyway 'git
-    # diff' only wants trees
-    my $oldtree = $oldsha eq '0' x 40 ? $empty : $oldsha;
-    my $newtree = $newsha eq '0' x 40 ? $empty : $newsha;
-    push @refs, map { chomp; s/^/NAME\//; $_; } `git diff --name-only $oldtree $newtree`;
-}
-
-# we potentially have many "refs" to check.  The one we print in the log is
-# the *first* one (which is a *real* ref, like refs/heads/master), while all
-# the rest (if they exist) are like NAME/something.  So we do the first one
-# separately to capture it, then run the rest (if any)
-my $log_refex = check_ref(\@allowed_refs, $ENV{GL_REPO}, (shift @refs), $att_acc);
-check_ref                (\@allowed_refs, $ENV{GL_REPO}, $_           , $att_acc) for @refs;
+# then we check all virtual refs
+check_vrefs(\@allowed_refs, $ENV{GL_REPO}, $att_acc);
 
 # if we returned at all, all the checks succeeded.  Check secondary hooks now
 $UPDATE_CHAINS_TO ||= 'hooks/update.secondary';
@@ -111,3 +91,50 @@ log_it("", "$att_acc\t" .  substr($oldsha, 0, 14) . "\t" . substr($newsha, 0, 14
     "\t$reported_repo\t$ref\t$log_refex");
 
 exit 0;
+
+# ----------------------------------------------------------------------
+
+sub check_vrefs {
+    my ( $ar_ref, $repo, $aa ) = @_;
+    # these will be passed on as args 1, 2, 4 to check_ref.  Arg-3 will be
+    # the new ref being checked.
+
+    # this sub uses $ref, $oldsha, and $newsha globals; they're pretty much
+    # 'constant' once you enter an update hook anyway
+
+    my $empty   = '4b825dc642cb6eb9a060e54bf8d69288fbee4904';            # this is special to git -- the hash of an empty tree
+    my $oldtree = $oldsha eq '0' x 40 ? $empty : $oldsha;
+    my $newtree = $newsha eq '0' x 40 ? $empty : $newsha;
+    my @first6  = ( $ref, $oldsha, $newsha, $oldtree, $newtree, $aa );
+
+    # first, handle the VREF thats's been in "core" forever...
+    if ( $repos{ $ENV{GL_REPO} }{NAME_LIMITS} ) {
+        for my $ref ( map { chomp; s/^/NAME\//; $_; } `git diff --name-only $oldtree $newtree` ) {
+            check_ref( $ar_ref, $repo, $ref, $aa );
+        }
+    }
+
+    my %vref_seen;
+
+    for my $vr ( grep { m(^VREF/) } map { $_->[1] } sort { $a->[0] <=> $b->[0] } @{$ar_ref} ) {
+        next if $vref_seen{$vr}++;
+
+        # find code pertaining to $vr and run it; see docs for details
+        my ( $dummy, $pgm, @args ) = split '/', $vr;
+        $pgm = "$ENV{GL_BINDIR}/gl-VREF-$pgm";
+        -x $pgm or die "can't find helper program for $vr\n";
+
+        open( my $fh, "-|", $pgm, @first6, $vr, @args ) or die "can't spawn helper program for $vr: $!\n";
+        while (<$fh>) {
+            my ( $vref, $deny_message ) = split( ' ', $_, 2 );
+            my $ret = check_ref( $ar_ref, $repo, $vref, $aa, 1 );
+            die "$ret\n" . ( $deny_message || '' ) if $ret =~ /DENIED/ and $ret !~ /by fallthru/;
+            # I could change check_ref to take one more argument, say
+            # 'fallthru_is_pass', but I want to keep these changes as
+            # isolated as possible for now
+        }
+        close($fh) or die $!
+          ? "Error closing sort pipe: $!"
+          : "Exit status $? from VREF helper program for $vr";
+    }
+}
diff --git a/src/gl-compile-conf b/src/gl-compile-conf
index 2f652ef..f497ae5 100755
--- a/src/gl-compile-conf
+++ b/src/gl-compile-conf
@@ -175,9 +175,9 @@ sub parse_conf_line
         @refs = qw(refs/.*) unless @refs;
         # deprecation warning
         map { print STDERR "WARNING: old syntax 'PATH/' found; please use new syntax 'NAME/'\n" if s(^PATH/)(NAME/) } @refs;
-        # fully qualify refs that dont start with "refs/" or "NAME/";
+        # fully qualify refs that dont start with "refs/" or "NAME/" or "VREF/";
         # prefix them with "refs/heads/"
-        @refs = map { m(^(refs|NAME)/) or s(^)(refs/heads/); $_ } @refs;
+        @refs = map { m(^(refs|NAME|VREF)/) or s(^)(refs/heads/); $_ } @refs;
         @refs = map { s(/USER/)(/\$gl_user/); $_ } @refs;
 
         # expand the user list, unless it is just "@all"