merge develop: integrate NotSummed wrapper + aggregate_count exposure

Two PRs landed on develop while this PR was open:
- #659: Element::NotSummed wrapper variant
- #658: aggregate_count proof verification under verify feature

Conflicts resolved in 8 files. The substantive resolution work:

DISCRIMINANT COLLISION. The shipped cidx PR used ElementType
discriminant 16 for CountIndexedTree and 17 for
ProvableCountIndexedTree. Develop's NotSummed PR allocated byte 16
as NOT_SUMMED_WRAPPER_DISCRIMINANT. Both are still pre-shipping, so
renumbering is safe — and since the NotSummed wrapper byte semantics
need to round-trip across the wire, the wrapper byte stays at 16
and the cidx discriminants shift:

  CountIndexedTree:                 16 → 17
  ProvableCountIndexedTree:         17 → 18
  NonCountedCountIndexedTree:       144 → 145 (= 0x80 | 17)
  NonCountedProvableCountIndexedTree: 145 → 146 (= 0x80 | 18)

ENUM VARIANT ORDER. Bincode encodes Element variants by ENUM ORDER
(not by ElementType discriminant). The Element enum has been
reordered so NotSummed appears at variant index 16 (matching
NOT_SUMMED_WRAPPER_DISCRIMINANT), and CountIndexedTree /
ProvableCountIndexedTree appear AFTER NotSummed at indices 17/18 —
matching their new ElementType discriminants. Without this
reordering, bincode would still write 16 for CountIndexedTree but
from_serialized_value would interpret 16 as the NotSummed wrapper.

WRAPPER NESTING CHECK in `from_serialized_value`: now explicitly
rejects both nested NonCounted and cross-nesting with NotSummed
(inner_byte == 15 || inner_byte == 16), in addition to the
existing reject-high-bit-twin guard.

Other resolutions are straightforward additions: both branches
added arms to match expressions across helpers.rs, tree_type.rs,
visualize.rs; merged additively. The two `mod tests` blocks in
grovedb-element/src/element/mod.rs (one from each PR) renamed the
cidx-side block to `cidx_tests` to avoid duplicate name.

All 1944+ workspace tests pass post-merge.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: QuantumExplorer

grovedb-element/Cargo.toml

@@ -27,3 +27,6 @@ verify = []
 constructor = []
 serde = ["dep:serde"]
 visualize = ["dep:grovedb-visualize"]
+
+[dev-dependencies]
+serde_json = "1"

grovedb-element/src/element/constructor.rs

@@ -429,24 +429,71 @@ impl Element {
     /// Wrap an element in `NonCounted` so it contributes 0 to its parent count
     /// tree's aggregate count when inserted. Sums (if any) still propagate.
     ///
-    /// Returns `InvalidInput` if `inner` is itself a `NonCounted`. Wrapping
-    /// is not idempotent at the type level — use `into_non_counted` to wrap
-    /// without that risk.
+    /// Returns `InvalidInput` if `inner` is already wrapped in any wrapper
+    /// variant (`NonCounted` or `NotSummed`) — the wrappers are mutually
+    /// exclusive and may not nest in either direction. Use
+    /// `into_non_counted` to wrap idempotently when `inner` may already be
+    /// `NonCounted`; use that helper's `Result` return for the
+    /// cross-wrapper case.
     pub fn new_non_counted(inner: Element) -> Result<Self, ElementError> {
-        if matches!(inner, Element::NonCounted(_)) {
+        if matches!(inner, Element::NonCounted(_) | Element::NotSummed(_)) {
             return Err(ElementError::InvalidInput(
-                "NonCounted cannot wrap another NonCounted",
+                "NonCounted cannot wrap another wrapper",
             ));
         }
         Ok(Element::NonCounted(Box::new(inner)))
     }
 
-    /// Wrap `self` in `NonCounted`. If `self` is already `NonCounted`, returns
-    /// `self` unchanged (idempotent).
-    pub fn into_non_counted(self) -> Self {
+    /// Wrap `self` in `NonCounted`. If `self` is already `NonCounted`,
+    /// returns it unchanged (idempotent on `NonCounted`).
+    ///
+    /// Returns `InvalidInput` if `self` is `NotSummed` — the two wrappers
+    /// are mutually exclusive. Callers that need the unconditional wrapping
+    /// path should ensure the input is a non-wrapper variant before calling.
+    pub fn into_non_counted(self) -> Result<Self, ElementError> {
+        match self {
+            Element::NonCounted(_) => Ok(self),
+            Element::NotSummed(_) => Err(ElementError::InvalidInput(
+                "cannot wrap NotSummed in NonCounted; wrappers are mutually exclusive",
+            )),
+            other => Ok(Element::NonCounted(Box::new(other))),
+        }
+    }
+
+    /// Wrap a sum-tree variant in `NotSummed` so it contributes 0 to its
+    /// parent sum tree's running sum when inserted. Counts (if any) still
+    /// propagate.
+    ///
+    /// Only the four sum-tree variants are accepted: `SumTree`, `BigSumTree`,
+    /// `CountSumTree`, `ProvableCountSumTree`. Any other element — including
+    /// items, sum items, references, non-sum trees, and any wrapper
+    /// (`NonCounted`, `NotSummed`) — is rejected with `InvalidInput`.
+    pub fn new_not_summed(inner: Element) -> Result<Self, ElementError> {
+        match inner {
+            Element::SumTree(..)
+            | Element::BigSumTree(..)
+            | Element::CountSumTree(..)
+            | Element::ProvableCountSumTree(..) => Ok(Element::NotSummed(Box::new(inner))),
+            _ => Err(ElementError::InvalidInput(
+                "NotSummed inner element must be a sum-tree variant (SumTree, BigSumTree, \
+                 CountSumTree, or ProvableCountSumTree)",
+            )),
+        }
+    }
+
+    /// Wrap `self` in `NotSummed`. If `self` is already `NotSummed`, returns
+    /// it unchanged (idempotent on `NotSummed`).
+    ///
+    /// Returns `InvalidInput` if `self` is `NonCounted` (the two wrappers
+    /// are mutually exclusive) or any non-sum-tree variant. Mirrors
+    /// [`Element::into_non_counted`].
+    pub fn into_not_summed(self) -> Result<Self, ElementError> {
         match self {
-            Element::NonCounted(_) => self,
-            other => Element::NonCounted(Box::new(other)),
+            Element::NotSummed(_) => Ok(self),
+            Element::NonCounted(_) => Err(ElementError::InvalidInput(
+                "cannot wrap NonCounted in NotSummed; wrappers are mutually exclusive",
+            )),
+            other => Self::new_not_summed(other),
         }
     }
 }