refactor(contract): move parameter votes from RunningContractState to MpcContract

crates/contract/src/api/attestation.rs

@@ -353,6 +353,7 @@ impl MpcContract {
                     BTreeMap::new(),
                 );
                 let res = running_state.transition_to_resharing_no_checks(&proposed_parameters);
+                self.parameters_votes.clear();
                 if let Some(resharing) = res {
                     self.protocol_state = ProtocolContractState::Resharing(resharing);
                 }
@@ -488,7 +489,9 @@ mod tests {
         submit_valid_attestations,
     };
     use crate::config::Config;
-    use crate::primitives::key_state::{AttemptId, EpochId, KeyForDomain, Keyset};
+    use crate::primitives::key_state::{
+        AttemptId, AuthenticatedAccountId, EpochId, KeyForDomain, Keyset,
+    };
     use crate::primitives::participants::{ParticipantId, Participants};
     use crate::primitives::test_utils::{
         bogus_ed25519_near_public_key, bogus_ed25519_public_key, bogus_tee_verifier_account_id,
@@ -1001,6 +1004,12 @@ mod tests {
                 .block_timestamp((ATTESTATION_EXPIRY_SECONDS + 1) * 1_000_000_000) // nanoseconds
                 .build()
         );
+        // A pending parameter vote must not survive the kickout's transition to Resharing.
+        let voter = AuthenticatedAccountId::new(parameters.participants()).unwrap();
+        let pending_proposal =
+            ProposedGovernanceThresholdParameters::new(parameters.clone(), BTreeMap::new());
+        contract.parameters_votes.vote(&pending_proposal, voter);
+        assert!(!contract.parameters_votes.is_empty());
 
         // Call verify_tee - should trigger resharing
         let result = contract.verify_tee();
@@ -1009,6 +1018,7 @@ mod tests {
             Ok(true),
             "verify_tee should return Ok(true) when threshold is met"
         );
+        assert!(contract.parameters_votes.is_empty());
 
         // Verify contract transitioned to Resharing state
         let ProtocolContractState::Resharing(resharing_state) = &contract.protocol_state else {

crates/contract/src/api/governance.rs

@@ -52,10 +52,11 @@ impl MpcContract {
         let proposed_participants = proposal.participants();
         match validation_result {
             TeeValidationResult::Full => {
-                if let Some(new_state) = self
-                    .protocol_state
-                    .vote_new_parameters(prospective_epoch_id, &proposal)?
-                {
+                if let Some(new_state) = self.protocol_state.vote_new_parameters(
+                    prospective_epoch_id,
+                    &proposal,
+                    &mut self.parameters_votes,
+                )? {
                     self.protocol_state = new_state;
                 }
                 Ok(())
@@ -99,6 +100,7 @@ impl MpcContract {
 
         if let Some(new_state) = self.protocol_state.vote_add_domains(domains)? {
             self.protocol_state = new_state;
+            self.parameters_votes.clear();
         }
         Ok(())
     }
@@ -121,12 +123,15 @@ mod tests {
     };
     use crate::dto_mapping::IntoInterfaceType;
     use crate::errors::{DomainError, InvalidCandidateSet, InvalidState, InvalidThreshold};
-    use crate::primitives::key_state::{AttemptId, KeyForDomain, Keyset};
+    use crate::primitives::key_state::{AttemptId, EpochId, KeyEventId, KeyForDomain, Keyset};
     use crate::primitives::participants::Participants;
-    use crate::primitives::test_utils::{bogus_tee_verifier_account_id, gen_participants};
-    use crate::primitives::threshold_votes::GovernanceThresholdParametersVotes;
+    use crate::primitives::test_utils::{
+        authenticate_account_as, bogus_tee_verifier_account_id, gen_participants,
+    };
     use crate::primitives::thresholds::GovernanceThresholdParameters;
     use crate::state::ProtocolContractState;
+    use crate::state::key_event::tests::find_leader;
+    use crate::tee::test_utils::Environment;
     use dtos::{Curve, DomainId, ParticipantCount, Protocol, ReconstructionThreshold};
     use near_mpc_contract_interface::types::DomainPurpose;
     use near_sdk::test_utils::VMContextBuilder;
@@ -482,11 +487,131 @@ mod tests {
             Error::InvalidState(InvalidState::NotParticipant { account_id }) if account_id == outsider
         );
         // Check that vote was not accepted.
+        assert_matches!(&contract.protocol_state, ProtocolContractState::Running(_));
+        assert!(contract.parameters_votes.is_empty());
+    }
+
+    #[test]
+    fn vote_add_domains__should_clear_pending_parameter_votes_on_transition() {
+        // Given
+        let (mut contract, participants, signer, domain_id) = setup_running_contract_with_domain(
+            3,
+            GovernanceThreshold::new(2),
+            ReconstructionThreshold::new(2),
+        );
+        let proposal = ProposedGovernanceThresholdParameters::new(
+            GovernanceThresholdParameters::new(participants.clone(), GovernanceThreshold::new(2))
+                .unwrap(),
+            BTreeMap::new(),
+        );
+        vote_params(&mut contract, &signer, &proposal).unwrap();
+        assert!(!contract.parameters_votes.is_empty());
+        let new_domain = dtos::DomainConfig {
+            id: DomainId(domain_id.0 + 1),
+            protocol: Protocol::CaitSith,
+            reconstruction_threshold: ReconstructionThreshold::new(2),
+            purpose: DomainPurpose::Sign,
+        };
+
+        // When
+        let mut env = Environment::new(Some(0), None, None);
+        for (account_id, _, _) in participants.participants() {
+            env.set_signer(account_id);
+            contract.vote_add_domains(vec![new_domain.clone()]).unwrap();
+        }
+
+        // Then
+        assert_matches!(
+            &contract.protocol_state,
+            ProtocolContractState::Initializing(_)
+        );
+        assert!(contract.parameters_votes.is_empty());
+    }
+
+    /// Installs a context where `account_id` calls as an attested participant: `init_running`
+    /// mocks each participant's attestation with its TLS key as the account key.
+    fn attested_context(participants: &Participants, account_id: &AccountId) {
+        let info = participants.info(account_id).unwrap();
+        Environment::new(Some(0), Some(account_id.clone()), None)
+            .set_pk(near_sdk::PublicKey::from(info.tls_public_key.clone()));
+    }
+
+    /// Drives a 3-participant Running contract with one domain into Resharing: every
+    /// participant votes `proposal`, a key refresh keeping participants and threshold.
+    fn resharing_contract_with_domain() -> (
+        MpcContract,
+        Participants,
+        DomainId,
+        ProposedGovernanceThresholdParameters,
+    ) {
+        let (mut contract, participants, _, domain_id) = setup_running_contract_with_domain(
+            3,
+            GovernanceThreshold::new(2),
+            ReconstructionThreshold::new(2),
+        );
+        let proposal = ProposedGovernanceThresholdParameters::new(
+            GovernanceThresholdParameters::new(participants.clone(), GovernanceThreshold::new(2))
+                .unwrap(),
+            BTreeMap::new(),
+        );
+        for (account_id, _, _) in participants.participants() {
+            vote_params(&mut contract, account_id, &proposal).unwrap();
+        }
+        assert_matches!(
+            &contract.protocol_state,
+            ProtocolContractState::Resharing(_)
+        );
+        (contract, participants, domain_id, proposal)
+    }
+
+    #[test]
+    fn vote_new_parameters__should_record_a_re_proposal_vote_while_resharing() {
+        // Given
+        let (mut contract, participants, _, proposal) = resharing_contract_with_domain();
+        let (voter, _, _) = &participants.participants()[0];
+        Environment::new(Some(0), Some(voter.clone()), None);
+
+        // When: a participant re-proposes at the next prospective epoch
+        let result =
+            contract.vote_new_parameters(dtos::EpochId::new(2), (&proposal).into_dto_type());
+
+        // Then
+        assert_matches!(result, Ok(()));
         assert_matches!(
             &contract.protocol_state,
-            ProtocolContractState::Running(state)
-                if state.parameters_votes == GovernanceThresholdParametersVotes::default()
+            ProtocolContractState::Resharing(_)
         );
+        assert!(!contract.parameters_votes.is_empty());
+    }
+
+    #[test]
+    fn vote_reshared__should_clear_pending_parameter_votes_on_transition() {
+        // Given: a Resharing contract holding a pending re-proposal vote
+        let (mut contract, participants, domain_id, proposal) = resharing_contract_with_domain();
+        let voter = authenticate_account_as(&participants.participants()[0].0, &participants);
+        contract.parameters_votes.vote(&proposal, voter);
+        assert!(!contract.parameters_votes.is_empty());
+
+        // When: the resharing completes
+        let ProtocolContractState::Resharing(resharing) = &contract.protocol_state else {
+            panic!("expected Resharing state");
+        };
+        let (leader, _) = find_leader(&resharing.resharing_key);
+        let key_event_id = KeyEventId {
+            attempt_id: AttemptId::new(),
+            domain_id,
+            epoch_id: EpochId::new(1),
+        };
+        attested_context(&participants, &leader);
+        contract.start_reshare_instance(key_event_id).unwrap();
+        for (account_id, _, _) in participants.participants() {
+            attested_context(&participants, account_id);
+            contract.vote_reshared(key_event_id).unwrap();
+        }
+
+        // Then
+        assert_matches!(&contract.protocol_state, ProtocolContractState::Running(_));
+        assert!(contract.parameters_votes.is_empty());
     }
 
     #[test]

crates/contract/src/api/key_events.rs

@@ -107,6 +107,7 @@ impl MpcContract {
         if let Some(new_state) = self.protocol_state.vote_reshared(key_event_id)? {
             // Resharing has concluded, transition to running state
             self.protocol_state = new_state;
+            self.parameters_votes.clear();
             self.recompute_available_foreign_chains();
 
             // Spawn a promise to clean up votes from non-participants.

crates/contract/src/api/lifecycle.rs

@@ -10,6 +10,7 @@ use crate::primitives::domain::{
     AddDomainsVotes, DomainRegistry, validate_domains_against_governance,
 };
 use crate::primitives::key_state::{EpochId, Keyset};
+use crate::primitives::threshold_votes::GovernanceThresholdParametersVotes;
 use crate::primitives::thresholds::GovernanceThresholdParameters;
 use crate::state::ProtocolContractState;
 use crate::state::running::RunningContractState;
@@ -75,6 +76,7 @@ impl MpcContract {
             tee_verifier_account_id,
             tee_verifier_votes: TeeVerifierVotes::default(),
             available_attestation_grants: IterableMap::new(StorageKey::AttestationGrants),
+            parameters_votes: GovernanceThresholdParametersVotes::default(),
         })
     }
 
@@ -154,6 +156,7 @@ impl MpcContract {
             tee_verifier_account_id,
             tee_verifier_votes: TeeVerifierVotes::default(),
             available_attestation_grants: IterableMap::new(StorageKey::AttestationGrants),
+            parameters_votes: GovernanceThresholdParametersVotes::default(),
         })
     }
 

crates/contract/src/api/test_utils.rs

@@ -295,6 +295,7 @@ impl MpcContract {
             tee_verifier_account_id: bogus_tee_verifier_account_id(),
             tee_verifier_votes: Default::default(),
             available_attestation_grants: IterableMap::new(StorageKey::AttestationGrants),
+            parameters_votes: Default::default(),
         }
     }
 }

crates/contract/src/dto_mapping.rs

@@ -14,6 +14,7 @@ use mpc_attestation::{
     collateral::Collateral,
 };
 use near_mpc_contract_interface::types as dtos;
+use std::collections::BTreeMap;
 
 use crate::{
     config::Config,
@@ -23,7 +24,6 @@ use crate::{
         domain::{AddDomainsVotes, DomainRegistry},
         key_state::{AuthenticatedAccountId, AuthenticatedParticipantId, KeyForDomain, Keyset},
         participants::{ParticipantInfo, Participants},
-        threshold_votes::GovernanceThresholdParametersVotes,
         thresholds::{GovernanceThresholdParameters, ProposedGovernanceThresholdParameters},
         votes::Votes,
     },
@@ -804,21 +804,6 @@ impl IntoInterfaceType<dtos::ProposedGovernanceThresholdParameters>
 
 // --- Voting types ---
 
-impl IntoInterfaceType<dtos::GovernanceThresholdParametersVotes>
-    for &GovernanceThresholdParametersVotes
-{
-    fn into_dto_type(self) -> dtos::GovernanceThresholdParametersVotes {
-        let proposal_by_account = self
-            .proposal_by_account
-            .iter()
-            .map(|(account, params)| (account.into_dto_type(), params.into_dto_type()))
-            .collect();
-        dtos::GovernanceThresholdParametersVotes {
-            proposal_by_account,
-        }
-    }
-}
-
 impl IntoInterfaceType<dtos::AddDomainsVotes> for &AddDomainsVotes {
     fn into_dto_type(self) -> dtos::AddDomainsVotes {
         dtos::AddDomainsVotes {
@@ -979,7 +964,10 @@ impl IntoInterfaceType<dtos::RunningContractState> for &RunningContractState {
             domains: (&self.domains).into_dto_type(),
             keyset: (&self.keyset).into_dto_type(),
             parameters: (&self.parameters).into_dto_type(),
-            parameters_votes: (&self.parameters_votes).into_dto_type(),
+            // TODO(#2825): reporting dropped ahead of the switch to hash-only votes.
+            parameters_votes: dtos::GovernanceThresholdParametersVotes {
+                proposal_by_account: BTreeMap::new(),
+            },
             add_domains_votes: (&self.add_domains_votes).into_dto_type(),
             previously_cancelled_resharing_epoch_id: self.previously_cancelled_resharing_epoch_id,
         }

crates/contract/src/lib.rs

@@ -30,7 +30,8 @@ mod sandbox_test_methods;
 pub use crate::pending_requests::MAX_PENDING_REQUEST_FAN_OUT;
 
 use crate::{
-    foreign_chains_metadata::ForeignChainsMetadata, tee::tee_state::TeeState,
+    foreign_chains_metadata::ForeignChainsMetadata,
+    primitives::threshold_votes::GovernanceThresholdParametersVotes, tee::tee_state::TeeState,
     tee::verifier_votes::TeeVerifierVotes, update::ContractUpdateVotes,
 };
 use config::Config;
@@ -66,6 +67,10 @@ pub struct MpcContract {
     tee_verifier_votes: TeeVerifierVotes,
     /// A row is removed at zero, so the map holds no entry for an account with none.
     available_attestation_grants: IterableMap<AccountId, u32>,
+    // TODO(#2825): make these storage-backed `Votes`, which is why they live outside the state.
+    /// Pending votes for new parameters; emptied on every protocol state transition except a
+    /// resharing cancellation.
+    parameters_votes: GovernanceThresholdParametersVotes,
 }
 
 impl Default for MpcContract {

crates/contract/src/primitives/threshold_votes.rs

@@ -6,10 +6,9 @@ use std::collections::BTreeMap;
 
 /// Tracks votes for proposed threshold parameters (new participants, threshold,
 /// and per-domain threshold updates). Each current participant can maintain one vote.
-// TODO(#2825): Replace with Votes<AuthenticatedAccountId> from votes.rs
-// once this type is moved out of RunningContractState (which requires Clone + PartialEq).
+// TODO(#2825): Replace with Votes<AuthenticatedAccountId> from votes.rs.
 #[near(serializers=[borsh])]
-#[derive(Clone, Debug, Default, PartialEq, Eq)]
+#[derive(Debug, Default)]
 pub struct GovernanceThresholdParametersVotes {
     pub(crate) proposal_by_account:
         BTreeMap<AuthenticatedAccountId, ProposedGovernanceThresholdParameters>,
@@ -52,6 +51,15 @@ impl GovernanceThresholdParametersVotes {
                 .count(),
         )
     }
+
+    pub fn clear(&mut self) {
+        self.proposal_by_account.clear();
+    }
+
+    #[cfg(test)]
+    pub fn is_empty(&self) -> bool {
+        self.proposal_by_account.is_empty()
+    }
 }
 
 #[cfg(test)]

crates/contract/src/snapshots/mpc_contract__tests__mpc_contract_borsh_schema_has_not_changed.snap

@@ -615,6 +615,10 @@ BorshSchemaContainer {
                         "available_attestation_grants",
                         "IterableMap",
                     ),
+                    (
+                        "parameters_votes",
+                        "GovernanceThresholdParametersVotes",
+                    ),
                 ],
             ),
         },
@@ -942,10 +946,6 @@ BorshSchemaContainer {
                         "parameters",
                         "GovernanceThresholdParameters",
                     ),
-                    (
-                        "parameters_votes",
-                        "GovernanceThresholdParametersVotes",
-                    ),
                     (
                         "add_domains_votes",
                         "AddDomainsVotes",