getShares

Every share, one row per (receiver, resourceUri) at the strongest mode: reified records first, then any legacy rows for pairs they don't cover. The several implied acl:modes a grant writes (e.g. Read+Append for "Add") are folded into the single logical level via collapseByReceiver, so a receiver never appears more than once per resource.