Protocol and evidence record for "Language models for insider threat detection: a systematic review of roles, claims and evidence" (release 3.1)

Protocol and evidence record of the systematic review reported in the Letter "Language models for insider threat detection: a systematic review of roles, claims and evidence" (Frontiers of Computer Science) and its Online Resource 1. Release 3.1 corresponds exactly to the second revision of the Letter: 29 identified studies, 27 analysed after an adjudicated re-appraisal of qualification; it changes no code and no count of release 3.0 and adds the reconciliation of the selection counts with the screening ledgers (per-family hit counts; 22 ledger-linked studies, six by citation chaining, one study entered under the version-2.0 amendment; the status of the two include-direct ledger families without a study, R051 and R171), the revised row labels of Letter Table 1 and Table S4, and the redrawn Fig. S1 with its source. It contains the coding book v3.0 (decision D1, materiality M1–M3, the four cell codes R/X/N/NA, rules G1–G7, RB0–RB8, RC1–RC8, RD1–RD6, RE1–RE2, RF1–RF3, AD1–AD8 and the 14 clarifications entered during adjudication); the search and screening ledgers inherited unchanged from release 1.1.1 (query strings per platform, the 478 exported records with deduplication and screening decisions, the 37 full-text assessments with reasons, the citation-chaining log); both coders' records for all 59 variables of all 29 studies, with their evidence registers; the adjudication log with a rule and a locator for every one of the 54 resolved cells; the pre-adjudication agreement statistics for the 35 compared variables; the adjudicated consensus table; and the derived tables and figures of the Letter and of Online Resource 1 with the scripts that regenerate and verify them in one command. README.md maps every published figure and table to the file and columns from which it was computed; PROVENANCE.md states how the coding records were produced. Version history: release 1.1.1 (18 July 2026, 29-study core); the 2.0 amendment of 25 July 2026 (security-log expansion of the original submission; documented, not deposited as a separate release); release 3.0 (expansion withdrawn, re-appraisal, independent double coding of all appraisal variables); release 3.1 (2 November 2026, ledger reconciliation and relabelled criteria, no change of code or count).