How to change code signing entitlements in Xcode for Watchkitapp & Extension

My app compiles and archives fine, but on upload to the Apple store it fails with the following error message:

Prepared archive for uploading Upload failed error: App Store Connect Operation Error ERROR ITMS-90046: "Invalid Code Signing Entitlements. Your application bundle's signature contains code signing entitlements that are not supported on iOS. Specifically, value 'WF3BGN675V.net.brian-fitzgerald.changes' for key 'application-identifier' in 'Payload/I-Ching.app/Watch/watchkitapp.app/watchkitapp' is not supported. This value should be a string starting with your TEAMID, followed by a dot '.', followed by the bundle identifier."

and

error: App Store Connect Operation Error ERROR ITMS-90046: "Invalid Code Signing Entitlements. Your application bundle's signature contains code signing entitlements that are not supported on iOS. Specifically, value 'WF3BGN675V.net.brian-fitzgerald.changes' for key 'application-identifier' in 'Payload/I-Ching.app/Watch/watchkitapp.app/PlugIns/watchkitapp Extension.appex/watchkitapp Extension' is not supported. This value should be a string starting with your TEAMID, followed by a dot '.', followed by the bundle identifier."

But the string displayed IS my TeamID followed by a dot followed by the bundle identifier!!! Or is it expecting the bundleidentifier for the watchkit? Because if so it's not taking it from the info.plist file for the watchkit app, where it's assigned to net.brian-fitzgerald.changes.watchkitapp

I've spent hours trying varying everything I can in signing authorities and provisioning profiles, fiddling with the bundle id hierarchies, cleaning and rebuilding and recleaning. The only results I get are a failure to build or a successful build with this message.

I've seen many other posts about other ITMS-90046 errors but nothing involving the watchkitapp and extension not reporting the proper team & bundle syntax.

What am I missing?

UPDATE: Following @Help's advice I regenerated my entitlements files by deleting the files themselves, and the paths to them from the project plist.

The problem persists but with a different error message:

And again there's no mismatch between the plist bundle identifier and the identifier in the provisioning profile. My Entitlements-Release.plist is:

    <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>application-identifier</key>
    <string>WF3BGN675V.net.brian-fitzgerald.changes</string>
    <key>aps-environment</key>
    <string>production</string>
    <key>com.apple.security.application-groups</key>
    <array>
        <string>group.net.brian-fitzgerald.changes</string>
    </array>
</dict>
</plist>

Found it. Literally days wasted on this, I hope this saves someone else some pulled hair.

The info.plist is not the only place the Watchkit and Watchkit Extension bundle identities are assigned. There's a bundle identifier key in Build Settings for the watchkit app and watchkit extension targets: no matter what you put in your info.plist, these are the ones that the provisioning profile looks at for a match:

Either those keys are new in Xcode 11 or they were always mis-set in my app. If the latter, I suspect the behaviour described here in the release notes for 11 was the culprit:

Xcode removes some entries from the Info.plist file of a product at build time if the entries are not appropriate for the platform being built for, which is useful for targets which are configured to build for multiple platforms. This behavior can be disabled by setting the build setting DISABLE_INFOPLIST_PLATFORM_PROCESSING to YES, in which case the target must assume the responsibility of managing these entries appropriately. (47797497)

To be clear, I did not set that key, but by setting the bundle identifier in the Watchkit to

net.brian-fitzgerald.changes.watchkitapp

and in the extension to

net.brian-fitzgerald.changes.watchkitapp.watchkitextension

I was able to assign the provisioning profiles with those identities to the targets and build and upload normally.

I have never been so happy to see the big green check mark for a successful upload. I thought my app was toast. If my analysis is correct, I hope Apple documents this one in the next release notes. I can't be the only one who will face this, and the log trail is pure misdirect.