On 3941ab4, tagged and untagged template substitution parsers call parseExpression but never require consumption of the entire extracted substitution or finalize pending cover-grammar early errors.
Confirmed against system JavaScriptCore:
`x${({__proto__: null, __proto__: {}})}`
String.raw`x${({__proto__: null, __proto__: {}})}`
`x${({a = 1})}`
`x${1 2}`
`x${1; 2}`zig-js accepts all of these; JSC raises SyntaxError. The equivalent tagged cases fail the same way. A 15-case differential including valid controls matches only 6/15 (nine invalid forms accepted).
Root cause: pending_proto_dup and pending_cover_inits are local to each Parser, and only Program/Module parsing checks them. Substitution parsers are discarded after parseExpression, including any unconsumed tokens and pending early errors. This bypasses Object Initializer early errors.
Plan: share a complete-substitution parser/finalization path between tagged and untagged templates, require EOF, and finalize cover errors only after assignment-pattern refinement. Preserve repeated proto names and shorthand defaults in genuine destructuring, legal comma expressions, and nested-template/CRLF diagnostic provenance. Verify no side effects precede the early error and test both Script and Module parsing.