Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/router/src/experimental/data-loaders/utils.ts`:
- Line 1: The TypeScript error comes from using the experimental LocationQuery
type in isSubsetOf while callers (e.g., RouteLocationNormalizedLoaded.to.query)
use the non-experimental shape; fix by widening isSubsetOf's parameter types to
accept the non-experimental query shape (use Record<string, string | null |
(string | null)[]> or import the LocationQuery type used by
RouteLocationNormalizedLoaded) so callers like to.query type-check; update the
type annotations in isSubsetOf (and any helper types in utils.ts) to the broader
union and adjust any internal handling to treat single string/null values as
single-item arrays if needed.

In `@packages/router/src/experimental/location.spec.ts`:
- Around line 8-236: Add explicit assertions in the location.spec tests to
verify the security invariant that parseURL returns a query object with a null
prototype; locate the parseURL expectations (e.g., in the tests like "works with
no query no hash", "extracts the query", and other cases referencing parseURL)
and after each expect(parseURL(...)).toEqual(...) add an additional assertion
that Object.getPrototypeOf(result.query) === null (or use
expect(Object.getPrototypeOf(result.query)).toBeNull()) so every relevant test
verifies the query object's prototype is null.

In `@packages/router/src/experimental/query.spec.ts`:
- Around line 18-23: Update the test for empty-string parsing to also assert the
returned object's prototype is null: after calling parseQuery('') and
parseQuery('?') (variables emptyQuery and the direct call), add assertions using
Object.getPrototypeOf(...) toBeNull (or equivalent) so the spec checks both
emptiness and the null-prototype hardening for parseQuery.

In `@packages/router/src/experimental/route-resolver/resolver-fixed.ts`:
- Around line 1-6: After switching to experimental normalizeQuery/parseQuery the
merged url.query can contain scalar strings because query.build(params) returns
plain strings that Object.assign overwrites array values with; to fix, after
merging call experimental_normalizeQuery (normalizeQuery) on the final url.query
to ensure every value is an array (or alternatively change
MatcherPatternQuery.build to return array values), i.e. locate the code that
does Object.assign into url.query and either adjust MatcherPatternQuery.build to
emit (string|null)[] for keys or simply post-process the merged object with
normalizeQuery(url.query) before using url.query and before calling query.match
so the shape always matches LocationQuery.

In `@packages/router/src/experimental/router.ts`:
- Around line 25-26: The EXPR option parseQuery declared on
EXPERIMENTAL_RouterOptions_Base (typed via originalParseQuery) is not used:
parseQuery is only a type (originalParseQuery) while its destructuring from
options (parseQuery) is commented out and resolver-fixed.ts hard-codes
experimental_parseQuery, so providing the option has no effect; fix by either
wiring the option through or warning—uncomment and reintroduce the parseQuery
destructuring in the router factory (so options.parseQuery is captured), change
resolver-fixed.ts to accept and call the provided parseQuery instead of using
experimental_parseQuery directly (fall back to experimental_parseQuery when
options.parseQuery is undefined), and add a __DEV__ warning if parseQuery is
present but not supported; alternatively remove parseQuery from
EXPERIMENTAL_RouterOptions_Base if you don’t intend to support it.

---

Outside diff comments:
In `@packages/router/src/experimental/route-resolver/resolver-fixed.spec.ts`:
- Around line 89-102: The match function in OPTIONAL_NUMBER_QUERY_MATCHER treats
query.count as a scalar but LocationQuery now makes it
(string|null)[]|undefined, so modify OPTIONAL_NUMBER_QUERY_MATCHER.match to
first unpack the array (e.g., const raw = Array.isArray(query.count) ?
query.count[0] : query.count), treat raw === null or raw === '' as the intended
null case, then parse Number(raw) and call miss on NaN; also update any test
utilities that read query.* as scalars to unpack the first array element before
processing to preserve the original null/empty behavior.

In `@packages/router/src/experimental/router.spec.ts`:
- Around line 1068-1085: The redirect for route "inc-query-hash" is
concatenating to.query.n (which is a (string|null)[]), causing array-to-string
coercion for multi-valued params; update the redirect handler for the
"inc-query-hash" route to explicitly read the first element (e.g., use
to.query.n?.[0] or similar null-safe access) before appending "-2" and building
the new query/hash so multi-valued n values aren't silently joined.

---

Nitpick comments:
In `@packages/router/src/experimental/query.ts`:
- Around line 72-78: The for...in loop in experimental_normalizeQuery can
include inherited enumerable properties; guard against that by only processing
own properties (e.g., add an hasOwnProperty check inside the loop or switch to
iterating Object.keys(query)/Object.entries(query)). Locate the loop that reads
"for (var key in query)" in experimental_normalizeQuery, skip keys where
!Object.prototype.hasOwnProperty.call(query, key), and keep the existing
normalization logic (isArray branch and value coercion) unchanged.