@@ -57,9 +57,9 @@ jobs:
             --seed "$FUZZ_SEED" \
             --artifact-dir .tmp/fuzz/run
 
-      # Uploaded on pass as well as failure: each subdirectory of .tmp/fuzz holds the standard
-      # scheduled-lane run-envelope.json (schemaVersion, commit/ref/run provenance, seed, config,
-      # per-target durations, result), which is what freshness/health monitoring reads.
+      # Uploaded on pass as well as failure: each subdirectory of .tmp/fuzz holds a
+      # run-envelope.json (schemaVersion, commit/ref/run provenance, seed, config, per-target
+      # durations, result), which is what freshness monitoring reads.
       - name: Upload run envelopes and failing cases
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
 
@@ -136,29 +136,17 @@ pnpm fuzz:parsers --self-check                     # require the harness to stil
 
 The generating run is nightly (`Parser Fuzz Lane` in `.github/workflows/replays-nightly.yml`, seeded
 by the run number). Every terminal path — pass, fail, `--self-check`, or a crash in the harness
-itself — writes `<artifact-dir>/run-envelope.json` in the standard scheduled-lane shape
-(`scripts/scheduled-lane/envelope.ts`: `schemaVersion`, `lane`, `result`, commit/ref/workflow-run
-provenance, seed and config, plus a lane-specific `details` payload — here per-target
-cases/failures/durations, failures, and repro commands). The nightly self-check and fuzz steps write
-to separate artifact subdirectories and both run unconditionally, so freshness/health monitoring
-(#1430) always finds an envelope; the step summary prints each one it finds and never fails on a
-missing file. Other scheduled lanes adopt the same writer rather than defining a second shape.
-
-### Scheduled lane health
-
-`pnpm lanes:health` is the consumer side of the envelope contract (#1430): it derives the lane list
-from `schedule:`-triggered workflows in `.github/workflows/` (never a hand-maintained list), reads
-each lane's recent scheduled runs from the GitHub API, and classifies it from recorded run fields —
-`healthy`, `failing` (two consecutive failed cadences), `dark` (no run within two cadences), or
-`pending` (no history to judge, e.g. a lane not on the default branch yet). A lane with no scheduled
-runs is judged against the commit that added its `schedule:` trigger, not the workflow's creation
-date, so adding a schedule to an old workflow still gets the full two-cadence grace — and an
-unreadable schedule date (shallow clone) stays `pending` rather than alerting. Freshness fields land
-in
-`lane-health.json` for the repo-health snapshot; an unhealthy lane opens or pings one tracking issue.
-It runs as `Scheduled Lane Health` (`.github/workflows/scheduled-lane-health.yml`) and locally with
-`--dry-run`, which never touches issues. Classification lives in
-`scripts/scheduled-lane/health-model.ts` and is unit-tested per category.
+itself — writes `<artifact-dir>/run-envelope.json` (`scripts/fuzz/envelope.ts`: `schemaVersion`,
+`lane`, `result`, commit/ref/workflow-run provenance, seed and config, plus per-target
+cases/failures/durations, failures, and repro commands), so a lane that goes dark or fails for weeks
+leaves a machine-readable trail. The self-check and fuzz steps write to separate artifact
+subdirectories and both run unconditionally; the step summary prints each envelope it finds and never
+fails on a missing file. The cross-lane version of this contract is #1430's own deliverable.
+
+Cases come from fast-check arbitraries (`scripts/fuzz/arbitraries.ts`) built on the hazard vocabulary
+shared with `src/__tests__/test-utils/property-arbitraries.ts`, so a hazard added for the property
+suite reaches the fuzz lane too — and a counterexample is reported **shrunk**, with fast-check's seed
+and replay path printed alongside the saved artifact.
 
 A nightly discovery reaches the unit lane by promotion, not hand-editing: the printed
 `promote:` command re-runs the downloaded artifact and appends it to
 
@@ -109,10 +109,9 @@
     "perf:ios": "node --experimental-strip-types scripts/perf/run.ts --platform ios",
     "perf:android": "node --experimental-strip-types scripts/perf/run.ts --platform android",
     "lint": "oxlint . --deny-warnings",
-    "format": "node ./node_modules/oxfmt/bin/oxfmt --write src test skills scripts/fuzz scripts/scheduled-lane scripts/help-conformance-bench.mjs scripts/help-conformance-case-checks.mjs scripts/help-conformance-command-validator.ts scripts/help-conformance-expectations.mjs scripts/help-conformance-plan-validator.mjs scripts/help-conformance-runner-output.mjs scripts/help-conformance-summary.mjs scripts/help-conformance-cases.mjs scripts/help-conformance-sample-outputs.mjs scripts/__tests__/help-conformance-bench.test.ts scripts/__tests__/help-conformance-sample-outputs.test.ts scripts/__tests__/help-conformance-topic-coverage.test.ts package.json tsconfig.json tsconfig.lib.json tsdown.config.ts vitest.config.ts .github/actions/setup-node-pnpm/action.yml .oxlintrc.json .oxfmtrc.json '!test/skillgym/.skillgym-results/**'",
-    "format:check": "node ./node_modules/oxfmt/bin/oxfmt --check src test skills scripts/fuzz scripts/scheduled-lane scripts/help-conformance-bench.mjs scripts/help-conformance-case-checks.mjs scripts/help-conformance-command-validator.ts scripts/help-conformance-expectations.mjs scripts/help-conformance-plan-validator.mjs scripts/help-conformance-runner-output.mjs scripts/help-conformance-summary.mjs scripts/help-conformance-cases.mjs scripts/help-conformance-sample-outputs.mjs scripts/__tests__/help-conformance-bench.test.ts scripts/__tests__/help-conformance-sample-outputs.test.ts scripts/__tests__/help-conformance-topic-coverage.test.ts package.json tsconfig.json tsconfig.lib.json tsdown.config.ts vitest.config.ts .github/actions/setup-node-pnpm/action.yml .oxlintrc.json .oxfmtrc.json '!test/skillgym/.skillgym-results/**'",
+    "format": "node ./node_modules/oxfmt/bin/oxfmt --write src test skills scripts/fuzz scripts/help-conformance-bench.mjs scripts/help-conformance-case-checks.mjs scripts/help-conformance-command-validator.ts scripts/help-conformance-expectations.mjs scripts/help-conformance-plan-validator.mjs scripts/help-conformance-runner-output.mjs scripts/help-conformance-summary.mjs scripts/help-conformance-cases.mjs scripts/help-conformance-sample-outputs.mjs scripts/__tests__/help-conformance-bench.test.ts scripts/__tests__/help-conformance-sample-outputs.test.ts scripts/__tests__/help-conformance-topic-coverage.test.ts package.json tsconfig.json tsconfig.lib.json tsdown.config.ts vitest.config.ts .github/actions/setup-node-pnpm/action.yml .oxlintrc.json .oxfmtrc.json '!test/skillgym/.skillgym-results/**'",
+    "format:check": "node ./node_modules/oxfmt/bin/oxfmt --check src test skills scripts/fuzz scripts/help-conformance-bench.mjs scripts/help-conformance-case-checks.mjs scripts/help-conformance-command-validator.ts scripts/help-conformance-expectations.mjs scripts/help-conformance-plan-validator.mjs scripts/help-conformance-runner-output.mjs scripts/help-conformance-summary.mjs scripts/help-conformance-cases.mjs scripts/help-conformance-sample-outputs.mjs scripts/__tests__/help-conformance-bench.test.ts scripts/__tests__/help-conformance-sample-outputs.test.ts scripts/__tests__/help-conformance-topic-coverage.test.ts package.json tsconfig.json tsconfig.lib.json tsdown.config.ts vitest.config.ts .github/actions/setup-node-pnpm/action.yml .oxlintrc.json .oxfmtrc.json '!test/skillgym/.skillgym-results/**'",
     "fuzz:parsers": "node --experimental-strip-types scripts/fuzz/run.ts",
-    "lanes:health": "node --experimental-strip-types scripts/scheduled-lane/health.ts",
     "fallow": "fallow audit --base origin/main",
     "fallow:all": "fallow --summary",
     "fallow:baseline": "(fallow dead-code --save-baseline fallow-baselines/dead-code.json --summary || true) && (fallow health --save-baseline fallow-baselines/health.json --summary || true)",
 
@@ -0,0 +1,114 @@
+// Case generators for the parser fuzz lane (#1414).
+//
+// fast-check rather than a bespoke PRNG, for two reasons the lane depends on: a reported
+// counterexample is the SHRUNK input (a hand-rolled mutator reports the 20k-character random one),
+// and the hazard vocabulary is the one #1437's property suite already curates — a hazard added
+// there for a round-trip property reaches the fuzzer without being retyped here.
+//
+// Cases stay near the grammar's edge on purpose: a well-formed base with hostile chunks spliced in
+// reaches deep parser branches that uniformly random noise never gets past the first token of.
+
+import fc from 'fast-check';
+import {
+  replayScriptArb,
+  SELECTOR_VALUE_HAZARDS,
+  selectorChainArb,
+} from '../../src/__tests__/test-utils/property-arbitraries.ts';
+import type { FuzzTarget, FuzzTargetName } from './target-types.ts';
+
+/**
+ * Hazards a valid-input property cannot use — they exist to be *rejected*: structural JSON/YAML
+ * punctuation, delimiter lookalikes, prototype-pollution keys, numeric edges, bidi/zero-width
+ * controls. The shared list above carries the ones valid inputs must also survive.
+ */
+const REJECTION_HAZARDS = [
+  '`',
+  '==',
+  '&&',
+  '--',
+  '---',
+  '#',
+  ':',
+  ',',
+  '{',
+  '}',
+  '[',
+  ']',
+  '(',
+  ')',
+  '${',
+  '${}',
+  '@',
+  '~=',
+  '*',
+  '\r\n',
+  '\u0000',
+  '\u200b',
+  '\u202e',
+  '\ufeff',
+  '-0',
+  'NaN',
+  'Infinity',
+  '1e999',
+  '9007199254740993',
+  'null',
+  'undefined',
+  '__proto__',
+  'constructor',
+] as const;
+
+const hazardArb: fc.Arbitrary<string> = fc.constantFrom(
+  ...SELECTOR_VALUE_HAZARDS,
+  ...REJECTION_HAZARDS,
+);
+
+/** A base string with 1–4 hazards spliced in at shrinkable positions. */
+function corrupted(base: fc.Arbitrary<string>): fc.Arbitrary<string> {
+  return fc
+    .tuple(
+      base,
+      fc.array(fc.tuple(hazardArb, fc.nat({ max: 4096 })), { minLength: 1, maxLength: 4 }),
+    )
+    .map(([text, edits]) =>
+      edits.reduce((current, [chunk, at]) => {
+        const index = at % (current.length + 1);
+        return current.slice(0, index) + chunk + current.slice(index);
+      }, text),
+    );
+}
+
+/** A long run of one hazard — regex-backtracking and quadratic-scan bait. */
+const repeatedHazardArb: fc.Arbitrary<string> = fc
+  .tuple(hazardArb, fc.integer({ min: 50, max: 400 }))
+  .map(([chunk, times]) => chunk.repeat(times));
+
+/** Input that is not trying to look like the grammar at all. */
+const noiseArb: fc.Arbitrary<string> = fc.oneof(
+  fc.string({ maxLength: 40 }),
+  fc.string({ unit: 'binary', maxLength: 40 }),
+  fc.array(hazardArb, { maxLength: 8 }).map((parts) => parts.join('')),
+  repeatedHazardArb,
+);
+
+/**
+ * Bases borrowed from the property suite, which generates *valid* inputs: corrupting a
+ * grammar-correct script or selector chain is how the fuzzer reaches branches past the first
+ * rejection. Targets without one generate from their own seed list.
+ */
+const STRUCTURED_BASES: Partial<Record<FuzzTargetName, fc.Arbitrary<string>>> = {
+  selector: selectorChainArb.map((chain) => chain.expression),
+  'replay-script': replayScriptArb,
+  'batch-steps': fc.json({ maxDepth: 3 }),
+};
+
+/** The case distribution for one target: mostly near-miss, some valid, some pure noise. */
+export function arbitraryForTarget(target: FuzzTarget): fc.Arbitrary<string> {
+  const seeded = fc.constantFrom(...target.seeds);
+  const structured = STRUCTURED_BASES[target.name];
+  const base = structured === undefined ? seeded : fc.oneof(seeded, structured);
+  return fc.oneof(
+    { weight: 6, arbitrary: corrupted(base) },
+    { weight: 2, arbitrary: base },
+    { weight: 2, arbitrary: noiseArb },
+  );
+}
@@ -5,12 +5,13 @@
 // Cases run synchronously here on purpose: a corpus case that hangs would hang the unit
 // suite, which is exactly the signal (the nightly lane is where hangs are diagnosed).
 
+import fc from 'fast-check';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { arbitraryForTarget } from './arbitraries.ts';
 import { readCorpus } from './corpus.ts';
 import { checkCase } from './invariant.ts';
 import { getFuzzTarget } from './registry.ts';
 import { FUZZ_TARGETS } from './targets.ts';
-import { generateCases } from './mutate.ts';
 
 describe('parser fuzz regression corpus', () => {
   const corpus = readCorpus();
@@ -50,15 +51,18 @@ describe('parser fuzz regression corpus', () => {
 });
 
 describe('fuzz case generation', () => {
-  it('is deterministic for a seed, so a repro command reproduces', () => {
-    const seeds = ['text=Login', 'label="Sign in" && role=button'];
-    expect(generateCases(seeds, 32, 7)).toEqual(generateCases(seeds, 32, 7));
-    expect(generateCases(seeds, 32, 7)).not.toEqual(generateCases(seeds, 32, 8));
+  const target = getFuzzTarget('selector');
+
+  it('is deterministic for a seed, so a reported counterexample replays', () => {
+    const sample = (seed: number) => fc.sample(arbitraryForTarget(target), { numRuns: 32, seed });
+    expect(sample(7)).toEqual(sample(7));
+    expect(sample(7)).not.toEqual(sample(8));
   });
 
-  it('always covers the verbatim seeds before mutating', () => {
-    const seeds = ['a', 'b', 'c'];
-    expect(generateCases(seeds, 1, 1)).toEqual(seeds);
-    expect(generateCases(seeds, 10, 1).slice(0, 3)).toEqual(seeds);
+  it('generates strings the target can be fed directly', () => {
+    for (const input of fc.sample(arbitraryForTarget(target), { numRuns: 64, seed: 1 })) {
+      expect(typeof input).toBe('string');
+      expect(checkCase(target, input)).toBeNull();
+    }
   });
 });
@@ -1,16 +1,17 @@
-// Parser fuzz lane's mapping onto the shared scheduled-lane envelope (#1414, #1430).
+// Run envelope for the parser fuzz lane (#1414).
 //
-// The shape lives in scripts/scheduled-lane/envelope.ts so freshness/health monitoring reads one
-// envelope contract across lanes; this module only supplies the fuzz-specific `details` payload
-// and guarantees an envelope exists for *every* terminal path — pass, fail, or self-check.
-
-import {
-  buildLaneEnvelope,
-  type LaneEnvelope,
-  writeLaneEnvelope,
-} from '../scheduled-lane/envelope.ts';
+// A scheduled lane goes dark quietly: it can stop running, or fail for weeks, while PR CI stays
+// green. Freshness monitoring therefore needs one machine-readable record per run — green runs
+// included — describing which commit, tool, config, and seed produced the verdict. This lane
+// writes that record on *every* terminal path: pass, fail, self-check, or a crash in the harness.
+// The cross-lane version of this contract is #1430's deliverable; this is only what this lane owes.
+
+import fs from 'node:fs';
+import path from 'node:path';
 import type { FuzzFailure } from './invariant.ts';
 
+const SCHEMA_VERSION = 1;
+const FILENAME = 'run-envelope.json';
 const LANE = 'parser-fuzz';
 const TOOL = 'scripts/fuzz/run.ts';
 
@@ -31,7 +32,46 @@ export type FuzzEnvelopeDetails = {
   reproCommands: string[];
 };
 
-export type FuzzRunEnvelope = LaneEnvelope<FuzzEnvelopeDetails>;
+export type FuzzRunEnvelope = {
+  schemaVersion: number;
+  lane: string;
+  /** `error` is for a run that could not complete itself (crash, bad config). */
+  result: 'pass' | 'fail' | 'error';
+  startedAt: string;
+  finishedAt: string;
+  durationMs: number;
+  provenance: {
+    commitSha: string | null;
+    ref: string | null;
+    workflow: string | null;
+    workflowRunId: string | null;
+    workflowRunNumber: string | null;
+    workflowRunAttempt: string | null;
+    nodeVersion: string;
+    tool: string;
+  };
+  /** Everything that decides what the run did: seed, sizes, budgets, selected work. */
+  config: Record<string, unknown>;
+  details: FuzzEnvelopeDetails;
+};
+
+function envOrNull(name: string): string | null {
+  return process.env[name] ?? null;
+}
+
+/** GitHub Actions exports these; a local run simply records `null`. */
+function provenanceFromEnv(): FuzzRunEnvelope['provenance'] {
+  return {
+    commitSha: envOrNull('GITHUB_SHA'),
+    ref: envOrNull('GITHUB_REF'),
+    workflow: envOrNull('GITHUB_WORKFLOW'),
+    workflowRunId: envOrNull('GITHUB_RUN_ID'),
+    workflowRunNumber: envOrNull('GITHUB_RUN_NUMBER'),
+    workflowRunAttempt: envOrNull('GITHUB_RUN_ATTEMPT'),
+    nodeVersion: process.version,
+    tool: TOOL,
+  };
+}
 
 /** Writes the envelope for one fuzz run into `artifactDir`; returns its path. */
 export function writeFuzzEnvelope(input: {
@@ -42,16 +82,19 @@ export function writeFuzzEnvelope(input: {
   config: Record<string, unknown>;
   details: FuzzEnvelopeDetails;
 }): string {
-  return writeLaneEnvelope(
-    input.artifactDir,
-    buildLaneEnvelope({
-      lane: LANE,
-      tool: TOOL,
-      result: input.result,
-      startedAt: input.startedAt,
-      finishedAt: input.finishedAt,
-      config: { mode: input.details.mode, ...input.config },
-      details: input.details,
-    }),
-  );
+  const envelope: FuzzRunEnvelope = {
+    schemaVersion: SCHEMA_VERSION,
+    lane: LANE,
+    result: input.result,
+    startedAt: new Date(input.startedAt).toISOString(),
+    finishedAt: new Date(input.finishedAt).toISOString(),
+    durationMs: input.finishedAt - input.startedAt,
+    provenance: provenanceFromEnv(),
+    config: { mode: input.details.mode, ...input.config },
+    details: input.details,
+  };
+  fs.mkdirSync(input.artifactDir, { recursive: true });
+  const file = path.join(input.artifactDir, FILENAME);
+  fs.writeFileSync(file, `${JSON.stringify(envelope, null, 2)}\n`);
+  return file;
 }