Verify past-session file provenance using docx metadata and transcript timestamps

To answer "did we make this file together in a past session?", don't rely on keyword grep over ~/.claude/projects/*/*.jsonl. Matches can be base64 noise from embedded images or later directory listings, so inspect each hit's context. Instead, get the file's creation time with mdls -name kMDItemContentCreationDate, then check for session activity in that window with grep -c '"timestamp":"YYYY-MM-DD' across all project dirs, including -private-tmp. Then run unzip -p f.docx docProps/core.xml and docProps/app.xml to read the creator, lastModifiedBy, revision count, total edit time and Application. Microsoft Word with a human author and many revisions, plus no sessions in the window, is strong evidence the file wasn't made in Claude Code, though it doesn't rule out text drafted elsewhere and pasted in.