diff --git a/test/cli.sh b/test/cli.sh
index 30baeae..66e6a53 100644
--- a/test/cli.sh
+++ b/test/cli.sh
@@ -3093,6 +3093,57 @@ check "revoke-user: the cert leftover check matches the capture, not a pipe" 0 "
 check "drill: reads the installed tree through current/" 0 "" \
   grep -qF '.local/share/box/current/VERSION' "$ROOT/drill/drill.sh"
 
+# ---------------------------------------------------------------------------
+# Drill record emission (#152). Feed the pure renderer facts captured by the
+# destructive harness and inspect the Markdown it writes; no fake Incus run is
+# mistaken for evidence from real hardware.
+# ---------------------------------------------------------------------------
+DRILL_RECORD_DIR="$(mktemp -d)"
+DRILL_RECORD="$DRILL_RECORD_DIR/0.9.1.md"
+
+drill_record_fixture() {
+  bash -c '
+    set -u
+    . "$1/drill/record.sh"
+    findings=("FAIL: sibling isolation regressed" $'"'"'NOTE: \033[33mcontainer fallback\033[0m'"'"')
+    drill_write_record "$2" \
+      "0.9.1" "drill-0.9.1-20260818-01" "builder / Debian 13, Incus 6.0.2" \
+      "2026-08-18" "heavy-duty/box" "release/0.9.1" \
+      "0123456789abcdef0123456789abcdef01234567" \
+      "heavy-duty/rig" "release/0.4.0" \
+      "89abcdef0123456789abcdef0123456789abcdef" \
+      "bash drill/drill.sh --ref release/0.9.1 --run-id drill-0.9.1-20260818-01" \
+      84 1 2460 findings
+  ' _ "$ROOT" "$DRILL_RECORD"
+}
+
+check "drill record: renderer writes a Markdown draft" 0 "" drill_record_fixture
+check "drill record: names the release version" 0 "# Release drill — 0.9.1" cat "$DRILL_RECORD"
+check "drill record: carries the shared run ID" 0 '**Run ID:** `drill-0.9.1-20260818-01`' cat "$DRILL_RECORD"
+check "drill record: pins the box ref and full SHA" 0 'box `release/0.9.1` @ `0123456789abcdef0123456789abcdef01234567`' cat "$DRILL_RECORD"
+check "drill record: pins the rig ref and full SHA" 0 'rig `release/0.4.0` @ `89abcdef0123456789abcdef0123456789abcdef`' cat "$DRILL_RECORD"
+check "drill record: records the invocation" 0 '`bash drill/drill.sh --ref release/0.9.1 --run-id drill-0.9.1-20260818-01`' cat "$DRILL_RECORD"
+check "drill record: renders pass/fail counts and wall clock" 0 '**84/85 passed, 1 failed.** 41 minutes wall clock.' cat "$DRILL_RECORD"
+check "drill record: carries plain findings" 0 '- FAIL: sibling isolation regressed' cat "$DRILL_RECORD"
+check "drill record: strips terminal colour" 1 $'\033' grep -q $'\033' "$DRILL_RECORD"
+
+printf 'operator evidence\n' > "$DRILL_RECORD_DIR/existing.md"
+check "drill record: refuses to overwrite evidence" 1 "already exists" \
+  bash -c '. "$1/drill/record.sh"; findings=(); drill_write_record "$2" v id host date repo ref sha rig rref rsha invocation 0 0 0 findings' \
+  _ "$ROOT" "$DRILL_RECORD_DIR/existing.md"
+check "drill record: an overwrite refusal preserves the file" 0 "operator evidence" cat "$DRILL_RECORD_DIR/existing.md"
+
+check "drill record: default run ID joins version and UTC date" 0 "drill-0.9.1-20260818-01" \
+  bash -c '. "$1/drill/record.sh"; drill_default_run_id 0.9.1 2026-08-18' _ "$ROOT"
+check "drill: help names --emit-record" 0 "--emit-record <path>" bash "$ROOT/drill/drill.sh" --help
+check "drill: help names --run-id" 0 "--run-id <id>" bash "$ROOT/drill/drill.sh" --help
+check "drill: --emit-record needs a value before any mutation" 2 "--emit-record needs a value" \
+  bash "$ROOT/drill/drill.sh" --emit-record
+check "drill: --run-id needs a value before any mutation" 2 "--run-id needs a value" \
+  bash "$ROOT/drill/drill.sh" --run-id
+
+rm -rf "$DRILL_RECORD_DIR"
+
 echo "---"
 echo "$PASS passed, $FAIL failed"
 rm -rf "$SHIMDIR" "$WORK"