diff --git a/packaging/flatpak/net.catcrafts.CrafterBuild.yaml b/packaging/flatpak/net.catcrafts.CrafterBuild.yaml
index 562a3fb..905485f 100644
--- a/packaging/flatpak/net.catcrafts.CrafterBuild.yaml
+++ b/packaging/flatpak/net.catcrafts.CrafterBuild.yaml
@@ -5,9 +5,14 @@
 # Platform: a build tool needs glibc's headers and crt objects, gcc's
 # libgcc_s, cmake, ninja, make, git and python at run time. Everything
 # compiler-shaped is ours and lives under /app: clang, lld, libclang, libc++,
-# compiler-rt (native and wasm32) and the WASI sysroot, all built from one
-# LLVM source tree so the modules crafter-build builds and the compiler that
-# consumes them can never drift apart.
+# compiler-rt (native and wasm32), lldb and the WASI sysroot, all built from
+# one LLVM source tree so the modules crafter-build builds and the compiler
+# that consumes them can never drift apart.
+#
+# Programs that `-r` and the test runner start run in this sandbox, so the
+# tools to debug them live here too: lldb (above), the Sdk's gdb, valgrind
+# and strace, and the Khronos Vulkan validation layers, GPU-assisted
+# validation included, which neither the Sdk nor its GL extensions carry.
 app-id: net.catcrafts.CrafterBuild
 runtime: org.freedesktop.Sdk
 runtime-version: '26.08'
@@ -25,13 +30,38 @@ finish-args:
   - --socket=fallback-x11
   - --socket=pulseaudio
   - --device=all
-  # gdb and friends from the Sdk
+  # lldb, and gdb and friends from the Sdk
   - --allow=devel
   - --env=PATH=/app/bin:/usr/bin
 cleanup:
   - /share/man
   - /share/doc
 modules:
+  - name: swig
+    # Generates lldb's Python bindings while the llvm module builds; nothing
+    # of it ships.
+    cleanup:
+      - '*'
+    sources:
+      - type: archive
+        url: https://downloads.sourceforge.net/project/swig/swig/swig-4.4.1/swig-4.4.1.tar.gz
+        sha256: 40162a706c56f7592d08fd52ef5511cb7ac191f3593cf07306a0a554c6281fcf
+
+  - name: libedit
+    # Line editing, history and completion at lldb's prompt. The Sdk has the
+    # ncurses it needs but not libedit itself; liblldb links the shared
+    # library, so that ships and the rest goes.
+    config-opts:
+      - --disable-static
+    cleanup:
+      - /include
+      - /lib/pkgconfig
+      - /lib/*.la
+    sources:
+      - type: archive
+        url: https://thrysoee.dk/editline/libedit-20260512-3.1.tar.gz
+        sha256: 432d5e7ea8b0116dd39f2eca7bc11d0eed77faa6b77ea526ace89907c23ea4a0
+
   - name: llvm
     buildsystem: cmake-ninja
     builddir: true
@@ -50,8 +80,20 @@ modules:
     config-opts:
       - -DCMAKE_BUILD_TYPE=Release
       - -DLLVM_ENABLE_ASSERTIONS=OFF
-      - -DLLVM_ENABLE_PROJECTS=clang;lld
+      - -DLLVM_ENABLE_PROJECTS=clang;lld;lldb
       - -DLLVM_ENABLE_RUNTIMES=compiler-rt;libcxx;libcxxabi;libunwind
+      # lldb with Python scripting (its bindings generated by the swig module
+      # above, against the Sdk's Python), libedit (the module above), curses,
+      # libxml2 and lzma, each set ON rather than left to the default of "if
+      # found", so a dependency gone missing fails the configure step instead
+      # of shipping an lldb without it. lldb-server, lldb-dap and lldb-mcp
+      # come with it.
+      - -DLLDB_ENABLE_PYTHON=ON
+      - -DLLDB_ENABLE_LIBEDIT=ON
+      - -DLLDB_ENABLE_CURSES=ON
+      - -DLLDB_ENABLE_LIBXML2=ON
+      - -DLLDB_ENABLE_LZMA=ON
+      - -DLLDB_ENABLE_LUA=OFF
       - -DLLVM_TARGETS_TO_BUILD=X86;AArch64;WebAssembly
       # Classic layout: libc++ in lib/ and include/c++/v1, not under a
       # per-target subdirectory, the same shape as a distro install.
@@ -82,6 +124,7 @@ modules:
       - /include/clang
       - /include/clang-tidy
       - /include/lld
+      - /include/lldb
       - /lib/cmake
       - /lib/*.a
       - /share/opt-viewer
@@ -219,6 +262,99 @@ modules:
         url: https://github.com/llvm/llvm-project/releases/download/llvmorg-22.1.8/llvm-project-22.1.8.src.tar.xz
         sha256: 922f1817a0df7b1489272d18134ee0087a8b068828f87ac63b9861b1a9965888
 
+  # The Khronos validation layers and the four modules they are built from,
+  # after llvm, so that bumping them reuses the cached LLVM build. All five
+  # are pinned to the Vulkan SDK release of the Sdk's own Vulkan loader and
+  # headers (1.4.357), at the dependency revisions that release's
+  # scripts/known_good.json names. When the runtime moves to a newer loader,
+  # move the layers to the SDK release of that loader and take the other
+  # four revisions from its known_good.json again. The four are built into
+  # /app at those revisions rather than taken from the Sdk, whose versions
+  # follow the runtime, and none of them ships.
+  - name: vulkan-headers
+    buildsystem: cmake-ninja
+    builddir: true
+    cleanup:
+      - '*'
+    sources:
+      - type: archive
+        url: https://github.com/KhronosGroup/Vulkan-Headers/archive/refs/tags/v1.4.357.tar.gz
+        sha256: 7dc0dbcf1d49dd3d7da3761c251c6097dfbaac475321a4a8a99269d3d5abecdc
+
+  - name: vulkan-utility-libraries
+    buildsystem: cmake-ninja
+    builddir: true
+    config-opts:
+      - -DCMAKE_BUILD_TYPE=Release
+      # CMake searches its install prefix after /usr, where the Sdk has
+      # Vulkan headers of its own.
+      - -DCMAKE_PREFIX_PATH=/app
+    cleanup:
+      - '*'
+    sources:
+      - type: archive
+        url: https://github.com/KhronosGroup/Vulkan-Utility-Libraries/archive/refs/tags/v1.4.357.tar.gz
+        sha256: e8688013cdc67dad26f15dcece91fa6b80ad595d551fceb56397fc4795efd00a
+
+  - name: spirv-headers
+    buildsystem: cmake-ninja
+    builddir: true
+    cleanup:
+      - '*'
+    sources:
+      - type: archive
+        url: https://github.com/KhronosGroup/SPIRV-Headers/archive/29981f65241605e08b0ede4cfeb999fe3b723c6a.tar.gz
+        sha256: 232899f1ad4104fb5bc377b94596c7621575eee62ad9a9e8f929b63a7dd8a7ad
+
+  - name: spirv-tools
+    # The optimizer GPU-assisted validation instruments shaders with, linked
+    # into the layer statically.
+    buildsystem: cmake-ninja
+    builddir: true
+    build-options:
+      no-debuginfo: true
+    config-opts:
+      - -DCMAKE_BUILD_TYPE=Release
+      # The installed SPIRV-Headers: its include/ holds the grammar files
+      # SPIRV-Tools generates its tables from, as the source tree does.
+      - -DSPIRV-Headers_SOURCE_DIR=/app
+      - -DSPIRV_SKIP_EXECUTABLES=ON
+      - -DSPIRV_WERROR=OFF
+    cleanup:
+      - '*'
+    sources:
+      - type: archive
+        url: https://github.com/KhronosGroup/SPIRV-Tools/archive/b707790a898e44038547df54580022fc1cf89c3d.tar.gz
+        sha256: 05d8af89737bde57571c48dbd36714c9f520a69623e14de72c3be6b600e277d6
+
+  - name: vulkan-validation-layers
+    # VK_LAYER_KHRONOS_validation. The loader finds its manifest under
+    # /app/share/vulkan/explicit_layer.d through XDG_DATA_DIRS, and the
+    # manifest names the library without a path, which the sandbox's loader
+    # finds in /app/lib. GPU-AV is a setting of this layer, not a layer of
+    # its own (VK_KHRONOS_VALIDATION_GPUAV_ENABLE=1, or the layer settings).
+    buildsystem: cmake-ninja
+    builddir: true
+    build-options:
+      no-debuginfo: true
+      strip: true
+    config-opts:
+      - -DCMAKE_BUILD_TYPE=Release
+      - -DCMAKE_PREFIX_PATH=/app
+      # ON by default: it clones every dependency with update_deps.py, which
+      # the build sandbox has no network for, instead of using the four
+      # modules above.
+      - -DUPDATE_DEPS=OFF
+      - -DBUILD_TESTS=OFF
+      - -DBUILD_WERROR=OFF
+    post-install:
+      - test -f /app/share/vulkan/explicit_layer.d/VkLayer_khronos_validation.json
+      - test -f /app/lib/libVkLayer_khronos_validation.so
+    sources:
+      - type: archive
+        url: https://github.com/KhronosGroup/Vulkan-ValidationLayers/archive/refs/tags/vulkan-sdk-1.4.357.0.tar.gz
+        sha256: 73180b11992a3554e97ebc18e6bf2b45ff9790ded9d87fc526c7bab865d1303f
+
   - name: crafter-build
     buildsystem: simple
     build-options: