The totalDeposited reflects all previous deposits

The setPermitSigner function swaps the key that checks new permits.

function setPermitSigner(address newPermitSigner) external onlyOwner {
    if (newPermitSigner == address(0)) {
        revert UnauthorizedSigner(newPermitSigner);
    }

    emit PermitSignerUpdated(permitSigner, newPermitSigner);
    permitSigner = newPermitSigner;
}

In this function, changing the signer only affects newly submitted PurchasePermits; existing deposits remain valid and continue contributing to totalDeposited and the cap. So if prior deposits are supposed to become invalid, the accounting could become inconsistent.

The MegaETH team responded that the permit signer validates eligibility at deposit time, so completed deposits remain valid historical records that continue contributing to totalDeposited and cap accounting.

The same perspective applies to the setSaleUUID function as well.