Protocol and evidence record for "Language models for insider threat detection: a systematic review of roles, claims and evidence" (release 3.0)

Protocol and evidence record of the systematic review reported in the Letter "Language models for insider threat detection: a systematic review of roles, claims and evidence" (Frontiers of Computer Science, manuscript FCS-261741) and its Online Resource 1. Release 3.0 corresponds exactly to the Letter: 29 identified studies, 27 analysed after an adjudicated re-appraisal of qualification. It contains the coding book v3.0 (decision D1, materiality M1–M3, the four cell codes R/X/N/NA, rules G1–G7, RB0–RB8, RC1–RC8, RD1–RD6, RE1–RE2, RF1–RF3, AD1–AD8 and the 14 clarifications entered during adjudication); the search and screening ledgers inherited unchanged from release 1.1.1 (the query strings per platform with scopes, dates and hit counts; the 478 exported records as 348 report families, each with its duplicate links, screening decision and reason; the aggregate selection counts, including the 37 full-text assessments and the 14 exclusions by reason; 28 result-page screenshots), with a crosswalk added in release 3.0 from each of the 29 studies to its ledger row, to citation chaining or to its entry under protocol version 2.0; both coders' records for all 59 variables of all 29 studies, with their evidence registers; the adjudication log with a rule and a locator for every one of the 54 resolved cells; the pre-adjudication agreement statistics for the 35 compared variables; the adjudicated consensus table; and the derived tables and figures of the Letter and of Online Resource 1 with the scripts that regenerate and verify them in one command. README.md maps every published figure and table to the file and columns from which it was computed; PROVENANCE.md states how the coding records were produced. Version history: release 1.1.1 (18 July 2026, 29-study core); the 2.0 amendment of 25 July 2026 (security-log expansion of the original submission; documented, not deposited as a separate release); release 3.0 (expansion withdrawn, re-appraisal, independent double coding of all appraisal variables).