Function is_cmd_naming_method 

pub fn is_cmd_naming_method(method: &str) -> bool

Whether a subprocess method NAMES the program (so its first string literal IS the command head to refine): Command::new("curl"), duct::cmd("curl", …). The head-refinement must fire ONLY here — an ALLOWLIST, not “any method except known modifiers”. A whole-crate-Exec crate classifies EVERY method as Exec, so a denylist leaked NON-naming methods that aren’t modifiers — a getter like CommandBuilder::get_env("psql") (reading back an env-var KEY, not a program) fed "psql" to the head classifier and FABRICATED Db (review find). Only new/cmd name a program; everything else (modifiers, getters get_*, custom builder methods) keeps the bare Exec cliff — under-refine (safe) rather than fabricate. std::process::Command is verb-precise so getters never fire Exec there anyway; the allowlist makes the whole-crate-Exec crates safe too.