#36183 span: diagnose dangling views from MakeByteSpan/MakeUCharSpan

• Catch dangling views created from temporary objects at compile time
• Prevent silent use-after-free bugs when converting temporary containers to spans

Adds Clang's LIFETIMEBOUND attribute to MakeByteSpan and MakeUCharSpan in src/span.h. Updates call sites in dbwrapper and unit tests where temporary views triggered the new diagnostic.

Problem: MakeByteSpan and MakeUCharSpan can construct spans pointing into temporary containers that are destroyed immediately, leaving dangling views without a compiler warning.

P3 · cleanup

• P3 because it helps catch developer lifetime mistakes without fixing an active runtime failure
• Adding compile-time lifetime diagnostics to utilities has modest leverage and is safe to defer

Extends lifetime diagnostics across utility span helpers, following up on #36164. While useful for preventing use-after-free mistakes during development, it addresses no reported runtime failure and is safe to defer.

Membership: Modifies shared span helper templates in src/span.h.

Factors: security/stability 1, bug 0, performance 0, user value 0, leverage 1

• Worth reviewing now to assess how to avoid false warnings on non-owning views

Reviewer jeanpablojp proposed using std::ranges::borrowed_range overloads to prevent false positives 9 days ago with no response from the author.

Author status: silent since 2026-09-07

Open concerns:

• jeanpablojp noted that unconditional LIFETIMEBOUND emits false warnings when wrapping non-owning views such as std::span, std::string_view, or leveldb::Slice, and suggested using std::ranges::borrowed_range constraints instead.

• Concept approval with reservations about false positive diagnostics (jeanpablojp)
• Unaddressed concern that lifetime annotations trigger false warnings on borrowed views (jeanpablojp)

Concept ACK from jeanpablojp, who flagged false positives on borrowed ranges and suggested an alternative design

The change receives conceptual support, but an open concern about false positive diagnostics forcing call-site workarounds remains unaddressed by the author.

• jeanpablojp commented 'Concept ACK' but explained that 'LIFETIMEBOUND on const V& claims the result borrows from v... so the annotation also fires on correct code' and proposed conditional overloads via std::ranges::borrowed_range.

Review verdicts (DrahtBot): 0

• Concept ACK: jeanpablojp

9 lines under test/bench/ci.

• src/dbwrapper.cpp +4/-2
• src/span.h +4/-2
• src/test/net_tests.cpp +4/-2
• src/test/serialize_tests.cpp +2/-1

This PR annotates MakeByteSpan and MakeUCharSpan with LIFETIMEBOUND to detect dangling spans created from temporary objects at compile time. It follows merged PR 36164 to improve developer diagnostics across utility helpers. Reviewer jeanpablojp Concept ACKed but demonstrated that the current implementation produces false positives on non-owning views like std::span and leveldb::Slice, suggesting constrained overloads instead. The PR is paused awaiting author engagement on this design feedback.