[TASK] Content Drive: browse scopes for All, site root and System Host

Description

Content Drive can express only one browse scope today: everything on the current site, at every depth, with System Host mixed in. Two things in the current implementation cause it.

The site root drops the folder constraint. When the path resolves to the site root, ContentDriveHelper sets skipFolder(true), and the SQL then never applies its id.parent_path = ? filter. Its own comment says why: "if we're setting a site-name directly, we care for all subfolders." So //site/ does not mean "the site root", it means "the whole site", and there is no way to ask for the items that sit at the root.

System Host can be added, never isolated. The host clause has two forms, +conhost:<site> or +(conhost:<site> OR conhost:SYSTEM_HOST). No branch produces System Host alone. appendSystemHostQuery in BrowserAPIImpl already emits id.host_inode = 'SYSTEM_HOST', but it is unreachable: it only fires when the query carries no site at all.

The two query builders disagree. buildPureESQuery forces the widened host clause whenever the folder is the system folder, regardless of what the caller asked for, while the SQL path honours the flag. Under the default HYBRID_SINGLE_CHUNKED_QUERY_ES heuristic the SQL clause governs, so this only bites under PURE_ES today, but the two must agree before scopes mean anything.

The practical consequence is that "browse the site" and "browse the site root" are the same request, and a user cannot get to System Host on its own at all.

What we need

Three scopes, surfaced in the sidebar. All and System Host are plain sections, not tree nodes: no expand arrow, no children, no folder semantics.

Sidebar entry	Content	Folders	System Host	Accepts drops
All (top)	The whole site, any depth	None, content only	The "Show System Host" chip decides	No. It is a view, not a destination
Site row, under SITE HIERARCHY	Only the items sitting at the site root	The top-level folders	Never	Yes, as today
A folder in the tree	Unchanged	Unchanged	Never	Yes, as today
System Host (bottom)	System Host content only	None. System Host has no folders	Only System Host	Yes, dropping moves content to System Host

The item counts in the prototype are not part of this.

What needs to change

Backend

• A scope field on the drive request form: ALL | ROOT | SYSTEM_HOST, defaulting to ALL so existing callers keep today's behavior. The AssetPicker shares this endpoint and has no scope concept, so the default leaves it untouched.
• ROOT simply stops calling skipFolder(true). The system folder's path is /, so the existing folder predicate already produces the right query.
• SYSTEM_HOST reaches the id.host_inode = 'SYSTEM_HOST' clause that already exists. To make that branch reachable while a site is present, forceSystemHost on BrowserQuery becomes three-state (include, exclude, only). Content Drive is its only caller, so the boolean can go.
• buildPureESQuery reads the same three-state instead of forcing System Host in whenever the folder is the system folder.
• includeSystemHost stays its own field, honored only when scope is ALL and ignored otherwise.
• Confirm the move endpoint accepts System Host as a destination. Moving to a host root is a different shape from moving into a folder, and dropping onto the System Host section depends on it.

Frontend

• Sidebar: an All section, the SITE HIERARCHY tree, and a System Host section. Selection is exclusive across the three. System Host is a drop target for both move and upload; All is inert.
• The site row now means the site root, so it stops listing everything on the site. In the All scope the listing stops requesting folders entirely, so the folder-only affordances in the table have nothing to act on there.
• Rename the "Show Shared Assets" chip to "Show System Host". Label only: the filter key stays sharedAssets, which is seeded into every Content Drive URL and is shared with the AssetPicker, so renaming the key would break links already in circulation and both surfaces at once.
• The chip appears only in the All scope, and keeps its value while another scope is selected so returning to All restores the choice. It cannot apply anywhere else: System Host content only ever sits at the System Host root, so it can never appear inside a site folder.
• Scope survives a URL restore like the other filters, so a shared link lands on the same view.

Tests

There is no coverage for includeSystemHost anywhere in Content Drive today. Each scope needs integration coverage, and a new test class has to be registered in a MainSuite or CI silently never runs it.

Out of scope

• "Children of the site root" as a separate scope. System Host has no folders, and site content cannot live under System Host, so the site hierarchy already covers everything below the root.
• Item counts next to the sidebar entries. Prototype only.

Adjacent bug, filed separately if it does not block this

Inside a folder, ContentDriveHelper sets ignoreSiteForFolders(true) and selectQuery then skips the host clause entirely. The only surviving constraint is id.parent_path = ?, which matches a path string rather than a folder id, so a folder path that exists on two sites can return content from both. Every scope here is defined relative to "the current site", so this is worth resolving alongside them.

Additional Context

Prototype and discussion

Related: #37166, which touches how Content Drive reports operations and surfaced this while looking at what a move actually changes in the listing.

Trace ContentDriveHelper, BrowserQuery, BrowserAPIImpl, buildPureESQuery, and selectQuery to map the existing folder and host predicates before changing scope handling. Then inspect the sidebar, URL filter restoration, move endpoint, and the relevant MainSuite registration. Done means All, site-root, folder, and System Host views have the specified filtering and drop behavior, with integration coverage for each scope.