Yes you can. Have the watchOS app embedded into the iOS app but only activated when the user has purchased the corresponding iAP from the iOS app. Examples of apps which does this includes Nano and 1Password. Search the web for “How to Sell watchOS Applications as an In-App Purchase” for more information.

What’s preventing you from separating out that user-specific slight difference out from the application bundle? That way you could notarize just one application bundle for all users.

What was the conclusion on this? Have you filed a bug? What is the policy on submitted notarization data? Confidentiality level of the submitted binaries (and disk images, which includes non-binaries). What is the data retention policy and duration? Is there a way to un-notarize a binary (i.e. remove copy on Apple’s servers) when there’s a need for that? (e.g. EU’s “right to forget” should a DMG contain data on a natural person, license expiration of contained photographs or clip-arts, etc)

Have you raised a DTS? What was the conclusion?

You should create a new Apple ID, ideally one that’s not associated to a person. Generate an App-Specific password using that new account. Finally invite the new Apple ID into the business account’s Apple Developer Program as a Developer role. Alternatively you could also create an API Key file and use that one for authentication. Search the web for “How to Securely Provide Apple ID Password into Notarization Build Jobs” for more details on using a dedicated Apple ID for notarization or creating and using an API key for that purpose (obviously I can’t link it here due to forum restrictions).

You could have another copy of your app (and thus, extension) installed that is not built for debugging. The Photos app could have loaded that one instead of the one made by Xcode. In this case, you could temporarily move all other copies of your app to the Trash and re-launch Photos in Xcode to debug your app extension.

This remains true as per Xcode 15.1 The folder "~/Library/Developer" needs to be a real folder, not a symlink to somewhere else.

This is a desired behavior since Flash SMS has been abused to send marketing messages. Moreover, some telcos themselves are abusing these Flash SMS and use this method to send their own marketing messages.