--request-id <uuid> — must come first; the UUID is echoed back in the JSON result as requestId so a host with multiple in-flight commands can match replies
--apply-target <user|project> — specifies where to save settings; the apply step validates that the proposal's scope matches the target (user ↔ scope=all, project ↔ scope=project)
--expect-sha256 <64-hex> — required before --apply-file; the apply refuses unless the file's bytes hash to the given SHA256
The proposal object returned by --propose now also includes the scope field.
Evidence
Command usage string (search for "--apply-target must be")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
