Your first takeaway has a mirror on the user side, and Apple's own consumer wording is the proof.
Notarisation is a malware-scan result, not an authorisation. Apple states what it means directly: "an app that has been notarized by Apple indicates that Apple checked it for malicious software and none was detected." And when it is missing, the alert users get is "macOS can't verify that the app is free of malware". Both sentences are about scanning. Neither claims anything about entitlements or App Services. So the gap you hit is not an edge case in the tooling, it is the actual scope of notarisation, stated on the box.
Which is why every check you ran was honest and none of them was relevant. spctl is the clearest example: run it on the broken export and it reports
App.app: accepted
source=Notarized Developer ID
It is telling you the truth about the only question it was ever asked. There is no line in that output for the profile, because provisioning is not what Gatekeeper adjudicates.
The user-facing half of this asymmetry is the same misreading in the opposite direction: people read "cannot verify that the app is free of malware" as a detection, when macOS keeps a separate alert for detections ("will damage your computer", and known malware gets moved to the Trash). Developers over-read notarisation as authorisation; users over-read it as a verdict. Same sentence, both times doing less than it appears to.
The /usr/bin/log one is going straight into my notes.
Your first takeaway has a mirror on the user side, and Apple's own consumer wording is the proof.
Notarisation is a malware-scan result, not an authorisation. Apple states what it means directly: "an app that has been notarized by Apple indicates that Apple checked it for malicious software and none was detected." And when it is missing, the alert users get is "macOS can't verify that the app is free of malware". Both sentences are about scanning. Neither claims anything about entitlements or App Services. So the gap you hit is not an edge case in the tooling, it is the actual scope of notarisation, stated on the box.
Which is why every check you ran was honest and none of them was relevant. spctl is the clearest example: run it on the broken export and it reports
It is telling you the truth about the only question it was ever asked. There is no line in that output for the profile, because provisioning is not what Gatekeeper adjudicates.
The user-facing half of this asymmetry is the same misreading in the opposite direction: people read "cannot verify that the app is free of malware" as a detection, when macOS keeps a separate alert for detections ("will damage your computer", and known malware gets moved to the Trash). Developers over-read notarisation as authorisation; users over-read it as a verdict. Same sentence, both times doing less than it appears to.
The /usr/bin/log one is going straight into my notes.