A second, non-app client: raw CloudKit REST only — no sync engine, no keychain, no device change tokens. Read-only, metadata only. Open this in Safari or Edge; Word is not involved.