svelte goes back to the declarative _server() form with an untrusted_init option on _simple_spawn instead of a one-caller spawn factory, the two lsp path-list keys share one parser (only the invalid-value result and the message differ), and the docs say the allowlisted servers run no project code rather than that they only parse files (yaml-language-server fetches the schemas a file names).