d.sato@acme-corp.com cloned 18 private repositories from github.com/acme-corp/* in a 40-minute window between 04:15 and 04:52 — 12× his weekly baseline of 1–2 clones. The cloned set includes unreleased-ml-pipeline (340 MB · 1,204 files · Source Code and IP), payments-core, and auth-gateway. No commits, PRs, or issues were created — the activity pattern is consistent with bulk download before departure. Alex Chen is investigating. 78% confidence: Devon could be setting up a new dev machine, but the 04:15 timing on a Sunday and the selection of 3 unreleased products raises the risk score.