"These "API" sources tell nothing about the stack usage of the IAP routines which is probably one of the reasons why applications using IAP crash."

No indeed, but you could test that fairly easily.

"Nor givw they clue how to cope with the watchdog."

That doesn't affect me, I don't use it.

"In one application, my colleague completely rewrote the IAP/bootloader"

Out of interest, how was he able to do that without knowledge of the 'secret' internals?

"They might at least publish details on register+stack usage."

Atmel's API code shows which registers are used, doesn't it? If one were really curious I imagine one could disassemble the boot code.