Extend the invariant testing of MiniPair (launch 114, this commit; live on Sepolia at 0x898a07c8911f43218c5c2e1b7ae8146026f7e040 and still unused, totalShares() == 0 on 2026-09-27) with properties the existing suite does not cover, then review it. Tests only: new files under test/; do not change src/, foundry.toml or lib/.

What MiniPair is (follow this, it is not a Uniswap V2 pair): one native-ETH / MSWAP pool with a 30 bps fee kept in the pool. Reserves are internal (getReserves()) and change only through addLiquidity, removeLiquidity, swapExactETHForTokens and swapExactTokensForETH; there is no sync, no skim and no LP token — providers hold internal shares (sharesOf, totalShares) and 1,000 shares are locked to address(0) on the first deposit. Later deposits either pull only the ratio-matched tokens (tokenOptimal rounded up) or use every token and refund surplus ETH. Plain ETH transfers revert (no receive). test/MiniPair.invariant.t.sol already checks reserves == balances with no donations, reserves == net flows, share conservation and quotes, and k per swap inside its handler; test/MiniPair.t.sol already fuzzes add-then-remove and round-trip swaps.

Add test/MiniPair.invariantDonations.t.sol with a new handler that also donates MSWAP directly, forces ETH in with vm.deal(address(pair), balance + x), deposits with deliberately mis-ratioed amounts to hit both deposit branches, and acts through a contract actor that rejects ETH (its removeLiquidity and token-to-ETH swaps must revert and leave all state unchanged). Invariants: (1) reserves ≤ balances at all times, and reserves still equal the ghost net flows, so donations never move reserves or quotes; (2) the value of one share never falls: k / totalShares² is non-decreasing across every action, checked as Math.mulDiv(kAfter, sharesBefore², sharesAfter²) ≥ kBefore; (3) for every actor, removing all its shares now would pay at most shares × reserve / totalShares of each side, and the sum over actors plus the locked shares' portion never exceeds the reserves; (4) once live, totalShares never drops below 1,000 and both reserves stay above zero; (5) a failed ETH send never leaves shares, reserves or balances changed. The profile sets fail_on_revert = true: bound inputs so every intended call succeeds, and model the rejecting actor's expected reverts with try/catch inside the handler. If a property fails on the unmodified contract, keep the test, write the shrunk sequence in a comment and let the review judge it; do not weaken it.