lang query param => default language => ui language => first form language?
Makes sense to me.
It feels like if someone wanted to use the browser language they wouldn't have set a default? But you're right that there's a risk without knowing for sure. The only bad case would be someone who wanted to let the browser dictate things and set an explicit default in their form, right? They'd need to update their form to remove the default to get the behavior they want. They could make that change today because it would currently make no difference.