What I was looking for
Which published formula each risk metric really computes, my own Cernos code included.
What I found
Two libraries can both be right and still disagree, because "K-ratio" or "Burke ratio" names a family of formulas. Code can even carry one version's citation while computing another's, and nobody re-derives a formula that already has a citation next to it.
My own Cernos code was labelled with Kestner's 2003 K-ratio but computed the 1996 version: 4.6 against 0.29 on the same 240 periods, and the 1996 form grows with the length of the record. A check against the primary source caught it.
The move
I check a metric against its primary source, not its name, before I set a threshold on it.