Answering a question from your question: The CKRecordZone documentation says:
The CKRecordZone object defines the scope for organizing related records in the database. Zones are an important part of organizing your data. Public and private databases have a single zone by default, and in a private database you can create additional custom zones as needed. Use custom zones to organize and encapsulate groups of related records in a private database. User zones also support other features, such as the ability to record multiple records as a single atomic transaction.
Thus, you cannot create a zone in a public database
You're right. A private database is always associated with only 1 apple identifier. If you want to receive notifications of changes in the private database, then both the user / device, the changes made, and the user / device who needs to receive the notification must be registered using the same Apple ID.
source share