An app is bound to the device implicitly, simply by being on it. And no, the device does not need to be identified. That was the whole point. The device is the driver of the installation/update, not the Store. (As it turns out, it is the combination of both. I cannot say I prefer that solution but at least it provides the answer.)

We don't know anything about purchased apps yet as there is no such support. But my case with two Jollas in the family sharing the same account shows that the streamlining you mention above does not work. At least not at the moment.

And therein I believe lies the crux of the whole thing. It is so common to bring up ideological issues to every discussion about anything even remotely connected to "Linux" and "open source" that people tend to automatically assume that every discussion is about ideological issues. I tried to convey all the time that I had technical reasons in mind, not ideological.

I know this is not the common way in the modern world but my approach to any problem is, "take as little as you need", as opposed to "take as much as you can get." That applies to buffer sizes as well as how much to pack on a holiday and... how much the central repository needs to know about each client.