[recommended] Env-var name constants are duplicated across two modules -- extract to a shared leaf at src/apm_cli/config.py:9
APM_ALLOW_PROTOCOL_FALLBACK and APM_GIT_PROTOCOL are declared as ENV_ALLOW_FALLBACK / ENV_PROTOCOL in transport_selection.py AND as _ENV_ALLOW_PROTOCOL_FALLBACK / _ENV_GIT_PROTOCOL in config.py. If either set is renamed, the two modules silently read different environment variables with no compiler or test catching the divergence. Fix: a zero-dependency src/apm_cli/deps/_env_keys.py (no imports) lets both modules import safely without a circular-import cycle.
Suggested: Create src/apm_cli/deps/_env_keys.py with ENV_PROTOCOL = "APM_GIT_PROTOCOL" and ENV_ALLOW_FALLBACK = "APM_ALLOW_PROTOCOL_FALLBACK", then import from it in both modules.

[nit] get_apm_protocol_pref() can leak the raw string "http" -- normalize to "https" at src/apm_cli/config.py:220
Docstring promises "ssh", "https", or None. APM_GIT_PROTOCOL=http returns raw "http". ProtocolPreference.from_str absorbs it correctly today, but any future caller pattern-matching on the return value will silently mis-handle it.
Suggested: return "https" if env_val == "http" else env_val

[nit] Two unjustified function-body lazy imports in install.py:1307
config.py is a leaf module with no circular-import risk. The underscore-alias inline import pattern signals "circular import workaround" -- using it without a cycle inverts the convention's meaning for future readers.

[recommended] apm config get / show surfaces stored value, not effective value at src/apm_cli/commands/config.py
get_allow_protocol_fallback() / get_ssh() are called for display. If a user has APM_ALLOW_PROTOCOL_FALLBACK=1 in their shell but false in config.json, apm config get allow-protocol-fallback prints False while apm install honours True. Call the env-resolving wrappers (get_apm_allow_protocol_fallback / get_apm_protocol_pref) for display, with source annotation when the env var wins.

[nit] Fallback-path labels use raw kebab-case key, inconsistent with surrounding labels
Surrounding fallback lines use Title Case (APM CLI Version, Temp Directory). New lines emit allow-protocol-fallback: and ssh: as raw keys.

[nit] Both new keys shown unconditionally at default False, adding noise to every user's output
Follow the temp-dir pattern: only show when the value is non-default. apm config get <key> can still show the explicit value on direct request.

[nit] Python str(bool) renders True/False; convention expects true/false
Config values are documented as lowercase booleans in the docs table. Use str(value).lower() at output sites.

[recommended] Config key ssh is ambiguous -- prefer prefer-ssh at src/apm_cli/commands/config.py
The bare key ssh reads as a feature toggle. npm uses the prefer-* pattern for protocol preference keys (prefer-offline, prefer-dedupe). prefer-ssh maps immediately onto the mental model. Renaming after users have set ssh in dotfiles is a breaking change.
Suggested: Rename config key to prefer-ssh (internal: prefer_ssh). Keep --ssh as the CLI flag unchanged.

[recommended] apm config always prints both keys at False, adding noise to every user's output
Violates "quiet on the happy path" -- noise for the 95% of users who have never changed these settings. Follow the temp-dir pattern.

[recommended] SSH auth error path doesn't hint at apm config set ssh true at src/apm_cli/commands/install.py
User who encounters Permission denied (publickey) or HTTPS clone failure has no way to discover the config key without reading docs. npm prints actionable hints at the point of failure.
Suggested: Add a transport-error hint in the clone failure branch pointing at apm config set ssh true.

[nit] Docs example resets preference with set ssh false instead of unset at docs/src/content/docs/reference/cli/config.md
apm config unset ssh is idiomatic; set false leaves an explicit false in config.json while unset removes the entry entirely.

[nit] allow-protocol-fallback called "legacy" in PR body but docs don't signal deprecation
If genuinely legacy, add a deprecation note so users know to prefer the explicit --ssh path going forward.

[recommended] Env-var constant duplication risks silent name-drift at src/apm_cli/config.py
_ENV_ALLOW_PROTOCOL_FALLBACK and _ENV_GIT_PROTOCOL are copy-pasted strings in config.py (lines 11-12) while transport_selection.py declares ENV_ALLOW_FALLBACK and ENV_PROTOCOL with the same string values. No compile-time or test-time assertion ensures they stay in sync.
Suggested: Add a standalone test asserting config._ENV_ALLOW_PROTOCOL_FALLBACK == transport_selection.ENV_ALLOW_FALLBACK, or refactor into a zero-dependency _env_keys.py module.

[recommended] get_apm_protocol_pref() accepts and returns "http" but docstring omits it at src/apm_cli/config.py:220
ProtocolPreference.from_str maps "http" to HTTPS correctly today, but any future call-site using the raw string would open an unauthenticated HTTP clone path. Normalize "http" to "https" before returning, or drop it from the accepted set.

[nit] Raw config value for allow_protocol_fallback returned without bool-coercion at src/apm_cli/config.py:202
A manually edited config.json with string "yes" or integer 1 activates the flag without going through the env-var truthy-set check. Wrap in bool() or validate on set_allow_protocol_fallback.

[recommended] Missing CHANGELOG entry in [Unreleased] at CHANGELOG.md
The prior SSH/transport feature (Transport Selection v1: honor user-specified transport, no silent downgrade #778) got a detailed changelog line. Suggested: "apm config set ssh true and apm config set allow-protocol-fallback true persist transport preferences to ~/.apm/config.json; SSH-only and corporate users no longer need to pass --ssh on every apm install invocation. Closes Support persisting CLI flags via apm config (e.g. allow-protocol-fallback, ssh) #1243. (feat: persist transport flags via apm config #1308)"

[nit] No first-run hook -- SSH-only users won't find this without reading docs
Consider a one-sentence callout on the apm install reference page pointing at apm config set ssh true.

[nit] Transport section placement on env-vars page buries the lead for new users
Moving "Transport and protocol" above "Registry (MCP and proxy)" keeps it closer to the auth/credential content where frustrated SSH users are already looking.

[recommended] Ghost call-sites bypass config layer: github_downloader.py and validation.py still call protocol_pref_from_env() / is_fallback_allowed() directly at src/apm_cli/deps/github_downloader.py
GithubDownloader.__init__ falls back to protocol_pref_from_env() and is_fallback_allowed() when the caller passes protocol_pref=None / allow_fallback=None. These functions read only the env var -- they never consult ~/.apm/config.json. Any caller that constructs GithubDownloader without explicit values silently reverts to env-only semantics. validation.py:317 has the same gap for is_fallback_allowed().

[recommended] get_apm_protocol_pref() silently accepts "http" but docstring promises only "ssh"/"https" at src/apm_cli/config.py:220
APM_GIT_PROTOCOL=http returns raw "http". In install.py this is immediately fed to ProtocolPreference.from_str("http") which maps it to ProtocolPreference.HTTPS -- no credentials travel over cleartext HTTP through this path. But if any future code uses the raw return value without passing it through from_str(), it could reach the _HTTP transport attempt. Reject "http" with a warning, or explicitly document and test the alias.

[nit] Late import inside function body for config helpers in install.py:1307 is unnecessary
config.py is already imported at the module level in install.py; no circular-import risk justifies the inline pattern.

[recommended] APM_GIT_PROTOCOL Notes column omits "http" as accepted value at docs/src/content/docs/reference/environment-variables.md
The code accepts "http" and ProtocolPreference.from_str maps it to HTTPS. Change "Accepted values: ssh, https." to "Accepted values: ssh, https, http (alias for https)."

[nit] apm config unset section doesn't explicitly mention new keys are reset via set false
A reader who tries apm config unset ssh will get an error with no explanation. Add: "This includes allow-protocol-fallback and ssh -- use apm config set allow-protocol-fallback false or apm config set ssh false to restore defaults."

[nit] allow-protocol-fallback example missing reset comment
The ssh example includes # Reset to default: apm config set ssh false but the allow-protocol-fallback example does not. Add for consistency.

[nit] Table ordering -- transport booleans appear between path-type keys
No change required for this PR. If the table grows, consider grouping by type.

[nit] Transport section placement in env-vars page is reasonable
No change required. Placement after Authentication and before Registry is logical.

[recommended] apm config unset allow-protocol-fallback / apm config unset ssh silently fails with exit 1
The unset command handler has explicit branches for temp-dir and copilot-cowork-skills-dir. allow-protocol-fallback and ssh have no branch, so apm config unset allow-protocol-fallback falls through to logger.error("Unknown configuration key") and sys.exit(1). No unset_allow_protocol_fallback or unset_ssh functions exist in config.py (grep confirmed). No test exercises runner.invoke(config, ["unset", "allow-protocol-fallback"]).
Proof (missing at unit): tests/unit/test_config_command.py::TestConfigUnset::test_unset_allow_protocol_fallback_exits_0 -- proves: Running apm config unset allow-protocol-fallback succeeds with exit 0, not silently fails with exit 1 [devx]
Suggested: Add unset_allow_protocol_fallback and unset_ssh to config.py, wire them in the unset handler, add tests.

[recommended] Install pipeline config-layer wiring has no integration test
The diff in install.py replaces protocol_pref_from_env() / is_fallback_allowed() with config helpers. All tests are unit-level with patch.object mocks. tests/integration/test_transport_selection_integration.py exists but grep for config/set_ssh/get_apm_protocol_pref returned 0 hits.
Proof (missing at integration-with-fixtures): tests/integration/test_transport_selection_integration.py::test_config_ssh_true_routes_install_to_ssh_transport -- proves: apm config set ssh true causes apm install to attempt SSH URLs -- the full config-to-install wiring is live, not just the helper in isolation [portability-by-manifest, devx]
Suggested: Add fixture-based integration test: set_ssh(True) against isolated config file, invoke install command, assert attempted clone URL starts with git@ or `(redacted)

[nit] APM_GIT_PROTOCOL=http path is untested
config.py:220 accepts "http". Grep of test files for APM_GIT_PROTOCOL.*http returned 0 hits.
Proof (missing at unit): tests/unit/test_protocol_config_precedence.py::TestProtocolPrefPrecedence::test_env_var_http_returns_http_string

[nit] Precedence tests simulate CLI flag with Python variable, not real CLI invocation
Tests like test_cli_flag_true_wins_over_everything set cli_flag = True and compute cli_flag or get_apm_allow_protocol_fallback(). Correctly tests the OR expression in install.py but does not verify Click wires the --allow-protocol-fallback option to the parameter.
Proof (passed at unit): tests/unit/test_protocol_config_precedence.py::TestAllowProtocolFallbackPrecedence::test_cli_flag_true_wins_over_everything -- proves: OR expression short-circuits correctly when CLI flag is True [devx]

[recommended] _ENV_ALLOW_PROTOCOL_FALLBACK / _ENV_GIT_PROTOCOL are declared twice -- once in config.py and once in transport_selection.py at src/apm_cli/config.py:11
The comment says 'to avoid a circular import' but duplicating the string literals is a latent drift risk: if either side renames the constant the other side silently diverges. Canonical fix: extract both constants to a thin third module (e.g. apm_cli/deps/transport_constants.py) with no imports from either consumer.
Suggested: Create src/apm_cli/deps/transport_constants.py containing the two constants; import from there in both config.py and transport_selection.py.

[recommended] Four unset_* functions in config.py repeat the same invalidate->load->del->write->invalidate pattern verbatim at src/apm_cli/config.py:136
DRY threshold exceeded (4 call sites). A _unset_config_key(key: str) private helper eliminates all repetition and makes future bug fixes single-site.
Suggested: Add def _unset_config_key(key: str) -> None: and delegate from all four unset_* functions.

[nit] _CONFIG_KEY_DISPLAY_NAMES still contains "ssh": "ssh" -- leftover from before the prefer_ssh rename at src/apm_cli/commands/config.py:24
Dead entry, correct key should be "prefer_ssh": "prefer-ssh".
Suggested: Replace "ssh": "ssh" with "prefer_ssh": "prefer-ssh".

[nit] In-constructor deferred imports in GitHubPackageDownloader.__init__ signal an unresolved layering tension at src/apm_cli/deps/github_downloader.py:188
Workaround for circular import; resolves cleanly once constants are extracted to a shared module.

[recommended] Stale "ssh": "ssh" entry in _CONFIG_KEY_DISPLAY_NAMES should be removed at src/apm_cli/commands/config.py:24
Maps to nothing used elsewhere and will silently diverge if the dict is ever iterated for validation or documentation generation.
Suggested: Delete "ssh": "ssh". Add "prefer_ssh": "prefer-ssh" if the dict is used for normalisation.

[recommended] allow-protocol-fallback and prefer-ssh always appear in config show, even when at their defaults at src/apm_cli/commands/config.py:137
temp-dir is guarded by if _temp_dir_val:. The new bools unconditionally emit rows showing False with no signal that these are defaults, not explicit choices. Violates signal-to-noise rule.
Suggested: Mirror the temp-dir pattern: only emit rows when value deviates from the default (True).

[recommended] Booleans render as Python-capitalised True/False instead of lowercase true/false at src/apm_cli/commands/config.py:137
CLI conventions (POSIX, YAML, JSON, every other config tool) use lowercase. Creates friction for users comparing output to documented values.
Suggested: Use str(val).lower() or a _fmt_bool helper throughout.

[nit] Fallback click.echo path uses kebab-case key names for new entries but a human-readable label for temp-dir at src/apm_cli/commands/config.py:181
Minor inconsistency in the fallback output path.
Suggested: Use human-readable labels: ' Allow Protocol Fallback: ...' and ' Prefer SSH Transport: ...'.

[nit] apm config get prints False for unset booleans but Not set (using system default) for unset temp-dir at src/apm_cli/commands/config.py:315
A user debugging the precedence chain cannot tell from this output which layer resolved the value.

[blocking] _CONFIG_KEY_DISPLAY_NAMES still maps "ssh": "ssh" instead of "prefer_ssh": "prefer-ssh" at src/apm_cli/commands/config.py:24
Internal config key was renamed but display-name table was not updated. Any code path that looks up the display name via the internal key will silently miss the entry, leaving prefer-ssh unlabelled or invisible in rendered output.
Suggested: Change "ssh": "ssh" to "prefer_ssh": "prefer-ssh".

[recommended] Docs say unset only works for path keys; code supports it for both new boolean keys too at docs/src/content/docs/reference/cli/config.md:48
config.md line 48 contradicts examples at lines 96-97 showing apm config unset prefer-ssh. Cannot both be correct.
Suggested: Update the ### apm config unset KEY description to include allow-protocol-fallback and prefer-ssh as valid targets.

[recommended] Stale ssh key reference in environment-variables.md resolution chain at docs/src/content/docs/reference/environment-variables.md:40
Line 40 describes APM_GIT_PROTOCOL resolution using ssh key in config.json, but the actual key is prefer_ssh. Users hand-editing config.json will write the wrong key and get silent no-op behaviour.
Suggested: Replace 'ssh key in ~/.apm/config.json' with 'prefer_ssh key' or reference the CLI name.

[recommended] prefer-ssh boolean has no prefer-https counterpart; users who want to force HTTPS have no config escape hatch at docs/src/content/docs/reference/cli/config.md:57
APM_GIT_PROTOCOL accepts both ssh and https, but config only controls SSH preference. No way to persist 'always use HTTPS' in config.
Suggested: Add a note: 'To force HTTPS in all contexts, use APM_GIT_PROTOCOL=https; there is currently no config-file equivalent for pinning HTTPS.'

[nit] config get output prints Python-cased False/True instead of lowercase false/true at src/apm_cli/commands/config.py:181
Suggested: Use str(val).lower() or explicit "true"/"false" strings.

[recommended] ~/.apm/ directory created without explicit mode restriction at src/apm_cli/config.py:23
ensure_config_exists() calls os.makedirs(CONFIG_DIR) with no mode argument. On a multi-user system the directory inherits the process umask (commonly 755), making config.json world-readable. allow_protocol_fallback: true is a security-relevant state that other local users could observe or tamper with.
Suggested: Use os.makedirs(CONFIG_DIR, mode=0o700, exist_ok=True) and os.chmod(CONFIG_FILE, 0o600) after initial creation.

[recommended] FALLBACK_HINT in transport_selection.py is now incomplete after this PR at src/apm_cli/deps/transport_selection.py:31
The hint reads 'pass --allow-protocol-fallback or set APM_ALLOW_PROTOCOL_FALLBACK=1'. After this PR a third source exists: apm config set allow-protocol-fallback true. Users will be confused about which mechanism to use.
Suggested: Update FALLBACK_HINT to include the config path. Add a note that the setting persists across sessions.

[recommended] No CI/shared-home warning when persisting allow_protocol_fallback: true at src/apm_cli/commands/config.py:254
A user who runs apm config set allow-protocol-fallback true in a CI environment where $HOME is shared silently enables fallback for all subsequent installs. No warning at write time.
Suggested: Emit logger.warning(...) when setting allow-protocol-fallback to True, noting that the setting persists and advising use of the env var in CI.

[nit] _CONFIG_KEY_DISPLAY_NAMES contains stale "ssh": "ssh" and is never read -- dead code at src/apm_cli/commands/config.py:24
Either delete the dict or correct the entry to "prefer_ssh": "prefer-ssh" and wire it up.

[recommended] authentication.md still teaches export APM_GIT_PROTOCOL=https without a forward-pointer to apm config set prefer-ssh false at docs/src/content/docs/getting-started/authentication.md
Line 449 is the exact moment an SSH-blocked user is looking for the escape hatch. Showing only the env-var form leaves them one shell-profile edit away from forgetting about APM config -- a high-intent conversion miss.
Suggested: After the export APM_GIT_PROTOCOL=https block, add: 'To persist this preference across sessions: apm config set prefer-ssh false'.

[recommended] CHANGELOG entry buries the user-facing hook inside a resolution-order explanation at CHANGELOG.md
The lead sentence front-loads the mechanism rather than the payoff. 'SSH users: you never have to type --ssh again' is what gets copy-pasted into a Slack or tweet.
Suggested: Rewrite the opening to lead with payoff: 'SSH-first teams can now run apm config set prefer-ssh true once and drop --ssh from every subsequent apm install.'

[nit] apm config unset prefer-ssh works but docs say only path keys are unsettable -- contradictory at docs/src/content/docs/reference/cli/config.md:48

[nit] No apm init or first-install touchpoint guides SSH-first users to discover prefer-ssh at docs/src/content/docs/getting-started/installation.md
Suggested: Add a post-install callout: 'SSH users: run apm config set prefer-ssh true once to avoid passing --ssh on every install.'

[recommended] Constructor docstring still says 'reads APM_GIT_PROTOCOL env' -- config layer is now consulted but not mentioned at src/apm_cli/deps/github_downloader.py:173
Lines 173-176 describe the protocol_pref=None fallback as env-only. The implementation now resolves env -> config -> default. A caller reading only the docstring will not know that a persisted config value can override their expectations.
Suggested: Update the docstring to mention ~/.apm/config.json as a resolution source.

[nit] allow_fallback_env variable name in validation.py is now misleading at src/apm_cli/install/validation.py:317
Reads from config (env > config > False) but _env suffix implies env-only. Will confuse future readers tracing why fallback is enabled despite no env var being set.
Suggested: Rename to allow_fallback or allow_fallback_cfg.

[blocking] environment-variables.md names the config key as ssh, not prefer-ssh at docs/src/content/docs/reference/environment-variables.md:40
Line 40 reads '-> ssh key in ~/.apm/config.json'. The actual CLI key is prefer-ssh. A user who runs apm config set ssh true will set an unrecognised key and get silent no-op behaviour. config.md correctly uses prefer-ssh throughout; env-vars.md contradicts it.
Suggested: Change '-> ssh key in ~/.apm/config.json' to '-> prefer-ssh key in ~/.apm/config.json'.

[blocking] apm config unset description contradicts the examples for prefer-ssh at docs/src/content/docs/reference/cli/config.md:48
Line 48 states 'Only temp-dir and copilot-cowork-skills-dir are unsettable; boolean keys are reset by set-ing them to their default.' Lines 96-97 show apm config unset prefer-ssh as valid. These cannot both be correct.
Suggested: Update line 48: 'Boolean keys (prefer-ssh, allow-protocol-fallback) can be removed with unset; the built-in default (false) then applies. temp-dir and copilot-cowork-skills-dir are also unsettable.'

[recommended] CHANGELOG [Unreleased] contains two separate ### Added sections at CHANGELOG.md:21
Keep a Changelog specifies one subsection per type per release. Having two ### Added headings will confuse changelog parsers and readers.
Suggested: Merge the second ### Added block's bullet points into the first, then delete the duplicate heading.

[nit] env-vars.md transport section intro has explanatory padding that could be tightened at docs/src/content/docs/reference/environment-variables.md:36
Suggested: 'These settings can also be persisted via apm config set.'

[recommended] No integration test exercises the config-file (not env-var) path of get_apm_allow_protocol_fallback through _validate_package_exists at tests/unit/install/test_validation_strict_transport.py
The existing integration test covers the env-var branch (APM_ALLOW_PROTOCOL_FALLBACK=1). The persisted-config branch -- where env var is absent and config file has allow_protocol_fallback: true -- is only covered by unit-level mocks. Install-pipeline surface floor tier is integration-with-fixtures.
Proof (missing): tests/unit/install/test_validation_strict_transport.py::test_config_persisted_allow_fallback_chains_both_schemes -- proves: When user has run apm config set allow-protocol-fallback true and no env var is set, _validate_package_exists still probes both transports [secure-by-default]

[recommended] Downloader constructor's config-aware default for protocol_pref has no integration test at tests/unit/deps/test_github_downloader_validation.py
The new branch where the constructor is instantiated without explicit protocol_pref and config file says prefer_ssh: true has no integration-with-fixtures test. Grepped all of tests/ for get_apm_protocol_pref and get_apm_allow_protocol_fallback: only hits in the two new unit files.
Proof (missing): tests/unit/deps/test_github_downloader_validation.py::test_constructor_reads_ssh_preference_from_config -- proves: When get_prefer_ssh returns True and no explicit protocol_pref arg is given, downloader selects SSH [devx]

[nit] test_protocol_config_precedence.py simulates CLI-flag path inline rather than calling real install dispatch at tests/unit/test_protocol_config_precedence.py
Future refactors of install.py could silently break the wiring. Not blocking -- install invocation is covered elsewhere and the config-module unit tests are well-targeted.

[recommended] ENV_PROTOCOL / ENV_ALLOW_FALLBACK constants are duplicated across transport_selection.py and config.py at src/apm_cli/deps/transport_selection.py
transport_selection.py defines ENV_PROTOCOL = 'APM_GIT_PROTOCOL' and ENV_ALLOW_FALLBACK = 'APM_ALLOW_PROTOCOL_FALLBACK'. config.py re-declares them as _ENV_GIT_PROTOCOL and _ENV_ALLOW_PROTOCOL_FALLBACK with an inline comment acknowledging the duplication. Two sources of truth for the same string literals; a future rename or typo fix in one won't propagate to the other.
Suggested: Extract to src/apm_cli/deps/transport_constants.py (no imports needed) and import from there in both modules. Eliminates duplication without reintroducing any circular import.

[recommended] get_apm_protocol_pref() cannot express an explicit HTTPS pin via config -- only SSH or None at src/apm_cli/config.py
Config layer exposes prefer_ssh: bool, mapping True to 'ssh' and False/absent to None. No way to pin HTTPS via apm config set without the env var. Users wanting to force HTTPS (overriding insteadOf rules) must use an env var.
Suggested: Either accept the asymmetry and document it in CLI help output, or introduce a string-valued prefer_protocol config key as a follow-on (keeping backward compat via migration in get_apm_protocol_pref).

[nit] Lazy imports inside __init__ body create invisible coupling at src/apm_cli/deps/github_downloader.py
Suggested: Add inline comments: # lazy: breaks config <-> deps circular import and # lazy: breaks orchestrator <-> downloader circular import.

[nit] _config_cache global is not thread-safe at src/apm_cli/config.py
Suggested: Add comment: # Not thread-safe; safe for single-threaded CLI use only.

[recommended] bare print() in base.py bypasses _rich_warning(), losing yellow coloring and framework consistency at src/apm_cli/adapters/client/base.py
_rich_warning() renders in yellow via _rich_echo, making warnings visually distinct. Every other warning in the codebase uses _rich_warning(); this is the only outlier.
Suggested: Replace print(f"[!] Warning: ...") with _rich_warning(...). Import _rich_warning at the top of the file.

[nit] Double-space after [!] in the print() format string is inconsistent with STATUS_SYMBOLS convention at src/apm_cli/adapters/client/base.py
Suggested: Use single space: "[!] Warning: "

[nit] Stray 'm' prefix mentioned in PR summary is not present in committed code -- no action needed

[nit] FALLBACK_HINT is plain prose in error body, not a formatted [i] hint line at src/apm_cli/deps/bare_cache.py
Suggested: After emitting the error, emit a separate _rich_info(plan.fallback_hint) line so the apm config set allow-protocol-fallback true command is visually distinct.

[recommended] apm config get (no-arg) silently omits prefer-ssh and allow-protocol-fallback when false at src/apm_cli/commands/config.py
A user running apm config get to audit settings will not see transport keys at all if at defaults. auto-integrate always appears; transport keys don't. Inconsistency causes confusion for GHES users verifying their setup.
Suggested: In the no-arg apm config get branch, always print both transport keys with their effective value. The rich table display can keep hide-when-false; the dedicated get path should be exhaustive.

[nit] The allow-protocol-fallback table description calls the fallback chain 'legacy', confusing for users being guided to enable it at docs/src/content/docs/reference/cli/config.md
Suggested: Drop 'legacy' unless there is a deprecation timeline to cite.

[nit] The unset success message parenthetical resolution hint is useful but missing from set at src/apm_cli/commands/config.py
Suggested: After successful set, append active resolution tier to help users understand what they have overridden.

[recommended] No CLI escape hatch to override allow-protocol-fallback=true from config back to false for a single run at src/apm_cli/commands/install.py
install.py uses allow_protocol_fallback = allow_protocol_fallback or _get_apm_apf(). If a user has persisted allow-protocol-fallback: true in config, there is no CLI flag to force-disable it for a single apm install. Only workaround is APM_ALLOW_PROTOCOL_FALLBACK=0, which is not discoverable.
Suggested: Replace the or with a tri-state: if the CLI flag was explicitly passed (not just defaulted to False), honour it as authoritative. Or add --no-allow-protocol-fallback.

[nit] CI warning for allow-protocol-fallback is post-write, not pre-write in src/apm_cli/commands/config.py
Suggested: Emit the CI warning before calling setter().

[nit] Protocol fallback does not re-verify repo identity after protocol swap -- but post-clone SHA pin check covers this
Suggested: Consider logging the resolved remote URL after a fallback clone for audit trail.

[recommended] Enterprise docs (adoption-playbook.md, index.md) have zero mention of prefer-ssh or SSH transport config at docs/src/content/docs/enterprise/adoption-playbook.md
GHES users navigate to the enterprise section first. If apm config set prefer-ssh true is not surfaced there, most won't find it through the reference CLI page.
Suggested: Add a 'SSH-only environments' callout with one paragraph and a two-command snippet. Cross-link to the config reference.

[recommended] CHANGELOG [Unreleased] leads with prefer-ssh (good) but it is visually buried under 6+ subsequent Added bullets at CHANGELOG.md
Suggested: Consider a 'Highlights' subsection with 2-3 bullets (prefer-ssh persistence, MCP registry v0.1, apm pack --json).

[nit] The prefer-ssh CHANGELOG sentence is accurate but 85 words -- too long for release social post at CHANGELOG.md
Suggested: Lead with: "SSH-only and GHES users: run apm config set prefer-ssh true once -- no more --ssh on every install."

[nit] No quickstart mention of SSH environments -- first-run GHES users hit HTTPS clone errors with no in-product nudge at docs/src/content/docs/getting-started/quick-start.md
Suggested: Add a collapsible 'Corporate/GHES environment?' tip block near the first apm install step.

[recommended] packages/apm-guide/commands.md config table omits prefer-ssh and allow-protocol-fallback at packages/apm-guide/.apm/skills/apm-usage/commands.md
The apm-guide skill is consumed by AI assistants. The config table still lists only auto-integrate, temp-dir, and copilot-cowork-skills-dir. Agents using this skill will not know the new transport-persistence keys exist.
Suggested: Add prefer-ssh and allow-protocol-fallback to the config get, set, and unset rows, mirroring the phrasing in reference/cli/config.md.

[recommended] authentication.md snippet recommends apm config set prefer-ssh false -- a no-op that adds confusion at docs/src/content/docs/getting-started/authentication.md
The default of prefer-ssh is false, so set prefer-ssh false changes nothing. The comment "# explicit: never prefer SSH" implies it is meaningful, which is misleading.
Suggested: Replace with: apm config unset prefer-ssh # revert a previously-set SSH preference

[recommended] config.md unset section claims "All settable keys are unsettable" but auto-integrate cannot be unset at docs/src/content/docs/reference/cli/config.md
The unset handler has no branch for auto-integrate. apm config unset auto-integrate exits with "Unknown configuration key". The doc claim is factually wrong.
Suggested: List explicitly the unsettable keys: temp-dir, copilot-cowork-skills-dir, prefer-ssh, allow-protocol-fallback. Note auto-integrate must be reset by setting it to its default.

[nit] CHANGELOG transport-config entry is accurate and placement in Added is correct; resolution-order sentence could be trimmed at CHANGELOG.md
Suggested: Optional trim; acceptable as-is.

[nit] environment-variables.md new rows use arrow notation inconsistently with other rows at docs/src/content/docs/reference/environment-variables.md
Suggested: Either convert to prose style or adopt arrows as the pattern for resolution-chain rows consistently.

[recommended] No integration-tier test exercises apm install with prefer-ssh sourced from config file (not CLI flag) at tests/integration/test_transport_selection_integration.py
GitHubPackageDownloader.__init__ calls get_apm_protocol_pref() when no explicit arg is passed. Existing integration tests pass ProtocolPreference.SSH directly, bypassing the config-resolution path. Silent breakage would affect all GHES users who ran apm config set prefer-ssh true.
Proof (missing at integration-with-fixtures): tests/integration/test_transport_selection_integration.py::test_prefer_ssh_from_config_wires_into_downloader -- proves: apm config set prefer-ssh true causes apm install to use SSH cloning without requiring --ssh CLI flag [secure-by-default, portability-by-manifest]
assert downloader.protocol_pref == ProtocolPreference.SSH # constructed with no explicit args, config has prefer_ssh=True
Suggested: Add fixture-based test writing prefer_ssh: true to temp config.json, constructing GitHubPackageDownloader() with no explicit args, asserting protocol_pref == ProtocolPreference.SSH.

[nit] No apm config unset prefer-ssh or allow-protocol-fallback CLI tests at tests/unit/test_config_command.py
Proof (missing at unit): tests/unit/test_config_command.py::test_unset_prefer_ssh_removes_key -- proves: apm config unset prefer-ssh removes the key so subsequent get returns default (false)
mock_update.assert_called_once_with({'prefer_ssh': None})
Suggested: Add unset tests mirroring the copilot_cowork_skills_dir pattern.

[nit] Unit tests for precedence chain don't exercise GitHubPackageDownloader constructor wiring at tests/unit/test_protocol_config_precedence.py
Proof (passed at unit): tests/unit/test_protocol_config_precedence.py::TestAllowProtocolFallbackPrecedence.test_env_var_empty_falls_through_to_config -- proves: Empty APM_ALLOW_PROTOCOL_FALLBACK env var falls through to config layer rather than being treated as falsy
assert cfg_module.get_apm_allow_protocol_fallback() is True # config=True, env=''
Suggested: No additional unit test needed here; covered by finding 1 (integration test).