Beware: what the proof could not prove

root cause — halo2_gadgets/src/ecc/chip/mul/incomplete.rs · L309-310

// the incomplete double-and-add loop kept the base constant across rows via q_mul_2,
// but never tied it to the real base point g_d - the base was free.
- region.assign_advice(|| "x_p", self.double_and_add.x_p, row + offset, || x_p)?;
- region.assign_advice(|| "y_p", self.y_p,                 row + offset, || y_p)?;
+ if row == 0 {
+     region.copy_advice(|| "base", self.base, 0, self.double_and_add.x_p, row)?;
+ }
// consequence: pk_d = [ivk]·g_d was never enforced, so the same note stays
// spendable under fresh nullifiers. Consensus only rejects repeated ones.

The two removed lines are the assignment the root cause names, at the file and lines it names. The three added lines are the shape of the constraint that was missing, reconstructed from that description rather than copied from the upstream commit.

ZIP 209 rejects any block that would drive a pool's balance below zero, so what a pool can pay out is bounded by what provably entered it. That is the layer at which the 21 million cap held. It says nothing about which notes inside the pool were real: forged and legitimate notes are indistinguishable once they are in, so the value a counterfeiter could have realised would have come out of other holders, not out of new supply. Both readings - unlimited counterfeit, and the cap intact - are true, at different layers.

GitHub · ZODL · Zcash Community Forum · Schneier on Security

timeline — patched before it was told

The confirmation on 30 May and the private coordination with miners and exchanges on 31 May are not separate rows in the corpus timeline; they are recorded inside B2's own account, opposite. Block heights appear here in the rows' own wording because the timeline's height field is unset on all nine of them.