Backport hotfixes 29-06-2026

[l0r1s]

Backports the following hotfixes to devnet-ready:

• Fix balancer performance #2803
• Hotifx: Allow locked alpha transfers in coldkey swaps #2810
• Apply tx & dispatch extensions conditionally #2812

[github-actions]

AI review — see the sticky summary comment for the verdict and the inline comments below for specific findings.

[github-actions]

[MEDIUM] Coldkey swap now writes AccountFlags without a weight update

This call mutates AccountFlags before every coldkey swap, and swap_coldkey_locks now also removes/inserts AccountFlags when moving the source flags to the destination. The generated weights still list AccountFlags as r:1 w:0 for both swap_coldkey_announced and swap_coldkey, and weights.rs is unchanged in this PR, so these runtime extrinsics are undercharged for the new storage writes. Regenerate the benchmarks/weights, or manually update the swap weights to include the additional AccountFlags read/write operations.

[github-actions]

🛡️ AI Review — Skeptic (security review)

VERDICT: VULNERABLE

BASELINE scrutiny: l0r1s has repo write permission, an established account, and many prior subtensor PRs; branch hotfixes-29-06-2026 -> devnet-ready; no Gittensor allowlist match found.

The diff does not modify .github/ai-review/*, .github/copilot-instructions.md, dependency manifests, or build scripts. I found one runtime resource-accounting issue in the coldkey-swap locked-alpha change.

Findings

Sev	File	Finding
MEDIUM	pallets/subtensor/src/swap/swap_coldkey.rs:28	Coldkey swap now writes AccountFlags without a weight update	inline

Conclusion

The PR appears legitimate, but the new AccountFlags writes in coldkey swap are not reflected in generated weights, leaving the runtime undercharging these extrinsics. Regenerate or adjust weights before merge.

---

# 🔍 AI Review — Auditor (domain review) has not yet run on this PR.

[github-actions]

🔄 AI review updated — Skeptic: VULNERABLE