A given key cannot be un-given, so revocation re-keys the shared subtree; new writes get new ciphertext and new tokens, old blobs are not rewritten, the old key opens only what it already saw, and others you shared with keep access.

Revocation is the honest cost of key-based sharing.

You shared a folder. Now you want it back. The friend still holds the key. Keys cannot be un-given.

So the folder gets a new key. The lock is changed. Everything beneath it is re-keyed.

New writes get new ciphertext. The old blobs are not rewritten. The old key simply opens nothing new.

The friend's old key still opens what they already saw. It opens nothing you write from now on.

Only the shared subtree pays the cost. Others you shared it with keep their access. The rest of your files are untouched.

Check yourself. After revocation, what can the former friend still read?