diff --git a/web/src/lib/sqlite.svelte.js b/web/src/lib/sqlite.svelte.js
index c127153..e6212c4 100644
--- a/web/src/lib/sqlite.svelte.js
+++ b/web/src/lib/sqlite.svelte.js
@@ -124,7 +124,12 @@ export class RemoteDatabase {
     const worker = this.#worker ?? (await this.#opening);
     const started = performance.now();
     try {
-      return await worker.db.query(sql, ...params);
+      // One array argument, never spread. The worker forwards its arguments to
+      // sql.js's exec(sql, params), which takes the whole parameter list as its
+      // second argument and ignores anything that is not an array — leaving
+      // every ? unbound, which reads as NULL. The library's own type says
+      // `...params`, and it is wrong.
+      return await worker.db.query(sql, params);
     } finally {
       await this.#account(worker, label ?? firstLine(sql), performance.now() - started);
     }
diff --git a/web/src/routes/[dataset]/+page.svelte b/web/src/routes/[dataset]/+page.svelte
index f613093..62d8959 100644
--- a/web/src/routes/[dataset]/+page.svelte
+++ b/web/src/routes/[dataset]/+page.svelte
@@ -1,6 +1,5 @@
 <script>
   import { browser } from "$app/environment";
-  import { replaceState } from "$app/navigation";
   import { base, resolve } from "$app/paths";
   import { page } from "$app/state";
   import CustomQuery from "$lib/components/custom-query.svelte";
@@ -54,10 +53,13 @@
   // the page and a copied URL still reproduces the search.
   function writeUrlQuery(q) {
     const route = resolve("/[dataset]", { dataset: dataset.id });
-    // The target IS resolve()'d; the lint rule cannot see through the template
-    // literal that appends the query string.
-    // eslint-disable-next-line svelte/no-navigation-without-resolve
-    replaceState(q ? `${route}?q=${encodeURIComponent(q)}` : route, page.state);
+    // The native History API rather than SvelteKit's replaceState: that one
+    // reaches into the client router's root component, which is undefined
+    // until the router has initialized, and then fails inside its own
+    // internals (sveltejs/kit#12204). Passing the current history.state back
+    // unchanged leaves SvelteKit's history bookkeeping intact, and nothing
+    // here reads page.url after the initial deep link.
+    history.replaceState(history.state, "", q ? `${route}?q=${encodeURIComponent(q)}` : route);
   }
 
   async function search(q) {