diff --git a/docs/state/build-state-gnome.json b/docs/state/build-state-gnome.json
index 55c9c919..98c88730 100644
--- a/docs/state/build-state-gnome.json
+++ b/docs/state/build-state-gnome.json
@@ -1,15 +1,15 @@
 {
  "schema": "hammer-build-state/1",
  "totals": {
-  "recipes": 768,
-  "nodes": 777,
+  "recipes": 772,
+  "nodes": 781,
   "sealed": 764,
-  "never": 2,
+  "never": 6,
   "debt": 2,
   "wanted": 9
  },
  "by_class": {
-  "c": 143,
+  "c": 147,
   "go": 362,
   "gui": 31,
   "kernel": 6,
@@ -17,7 +17,7 @@
   "wanted": 9
  },
  "debt_by_class": {
-  "c": 2,
+  "c": 6,
   "gui": 1,
   "rust": 1
  },
@@ -28,6 +28,7 @@
    "debt": 2
   },
   "incoming-gnome": {
+   "never": 4,
    "wanted": 9
   }
  },
@@ -53,7 +54,7 @@
    "debt": 2
   }
  },
- "sin_perfil": 675,
+ "sin_perfil": 679,
  "orphan_deps": [],
  "topo_ok": true,
  "nodes": {
@@ -1834,6 +1835,21 @@
    "perfiles": [],
    "dependientes_total": 0
   },
+  "cbindgen": {
+   "iname": "cbindgen",
+   "version": "0.27.0",
+   "link": "static",
+   "compiler": "gcc",
+   "deps": [],
+   "cls": "c",
+   "queue": "incoming-gnome",
+   "hash": "b3:421f56b06606fb9f0c8686cb347f0d878a452c43c0f76656e97eaf797caaffab",
+   "state": "never",
+   "blocked_by": [],
+   "unblocks": 1,
+   "perfiles": [],
+   "dependientes_total": 1
+  },
   "cdncheck": {
    "iname": "cdncheck",
    "version": "1.2.41",
@@ -8312,14 +8328,14 @@
    "hash": "b3:fbad44acdc76df4b081cccd3cc02666664b6d1a03cd6fa482f85791fa533a602",
    "state": "sealed",
    "blocked_by": [],
-   "unblocks": 1,
+   "unblocks": 4,
    "perfiles": [
     "base",
     "cli",
     "escritorio-kde",
     "escritorio-mirada"
    ],
-   "dependientes_total": 80
+   "dependientes_total": 83
   },
   "mako": {
    "iname": "mako",
@@ -9092,6 +9108,23 @@
    "perfiles": [],
    "dependientes_total": 0
   },
+  "nasm": {
+   "iname": "nasm",
+   "version": "2.16.03",
+   "link": "static",
+   "compiler": "gcc",
+   "deps": [
+    "make"
+   ],
+   "cls": "c",
+   "queue": "incoming-gnome",
+   "hash": "b3:33383070e28a0e75d4f6ddaa9e93a13968e8ad1932c6c149ad04defac660f9f0",
+   "state": "never",
+   "blocked_by": [],
+   "unblocks": 1,
+   "perfiles": [],
+   "dependientes_total": 1
+  },
   "natls": {
    "iname": "natls",
    "version": "2.1.14",
@@ -9341,6 +9374,23 @@
    ],
    "dependientes_total": 1
   },
+  "nspr": {
+   "iname": "nspr",
+   "version": "4.36",
+   "link": "dynamic",
+   "compiler": "gcc",
+   "deps": [
+    "make"
+   ],
+   "cls": "c",
+   "queue": "incoming-gnome",
+   "hash": "b3:d7b71315b334e4bb7b34670a070a37f273611c87b7c1b2d59c6576dec0b4baaa",
+   "state": "never",
+   "blocked_by": [],
+   "unblocks": 1,
+   "perfiles": [],
+   "dependientes_total": 1
+  },
   "nsq": {
    "iname": "nsq",
    "version": "1.3.0",
@@ -10042,14 +10092,14 @@
    "hash": "b3:f0b5d0b1cb4321b3c61f24a871b9a58da3ebb7eb903af4015e35bd41a6465437",
    "state": "sealed",
    "blocked_by": [],
-   "unblocks": 2,
+   "unblocks": 3,
    "perfiles": [
     "base",
     "cli",
     "escritorio-kde",
     "escritorio-mirada"
    ],
-   "dependientes_total": 248
+   "dependientes_total": 249
   },
   "plow": {
    "iname": "plow",
@@ -10335,14 +10385,14 @@
    "hash": "b3:27889026076514935b53d486951792d08ed7fd5210b44e7f92979c03c96be665",
    "state": "sealed",
    "blocked_by": [],
-   "unblocks": 0,
+   "unblocks": 1,
    "perfiles": [
     "base",
     "cli",
     "escritorio-kde",
     "escritorio-mirada"
    ],
-   "dependientes_total": 196
+   "dependientes_total": 197
   },
   "qrcp": {
    "iname": "qrcp",
@@ -11386,6 +11436,33 @@
    "perfiles": [],
    "dependientes_total": 0
   },
+  "spidermonkey": {
+   "iname": "spidermonkey",
+   "version": "128.14.0",
+   "link": "dynamic",
+   "compiler": "clang",
+   "deps": [
+    "nspr",
+    "nasm",
+    "cbindgen",
+    "python3",
+    "make",
+    "zlib",
+    "pkgconf"
+   ],
+   "cls": "c",
+   "queue": "incoming-gnome",
+   "hash": "b3:4af195b63a28aee59d3c0f7bd1e506293ead41013c6534901c1771e84f46039b",
+   "state": "never",
+   "blocked_by": [
+    "nspr",
+    "nasm",
+    "cbindgen"
+   ],
+   "unblocks": 0,
+   "perfiles": [],
+   "dependientes_total": 0
+  },
   "sq": {
    "iname": "sq",
    "version": "0.50.0",
@@ -13548,14 +13625,14 @@
    "hash": "b3:28522f99f433496dbaacfa309f8e937d6526ac3c8db34b4a94b18e22656dcd33",
    "state": "sealed",
    "blocked_by": [],
-   "unblocks": 3,
+   "unblocks": 4,
    "perfiles": [
     "base",
     "cli",
     "escritorio-kde",
     "escritorio-mirada"
    ],
-   "dependientes_total": 67
+   "dependientes_total": 68
   },
   "zlib-ng": {
    "iname": "zlib-ng",
diff --git a/recipes/incoming-gnome/cbindgen.toml b/recipes/incoming-gnome/cbindgen.toml
new file mode 100644
index 00000000..db59c55a
--- /dev/null
+++ b/recipes/incoming-gnome/cbindgen.toml
@@ -0,0 +1,20 @@
+# cbindgen — genera headers C/C++ desde código Rust. Herramienta de BUILD de mozjs (el build de
+# SpiderMonkey invoca cbindgen para los bindings de sus crates Rust). Binario Rust; el lab lo detecta
+# como BuildSys::Cargo (hay Cargo.toml + Cargo.lock en el tarball de GitHub) y hace `cargo vendor` en el
+# fetch + `cargo build --release --locked --offline` en el sandbox. Sin sys-crates C ⇒ no necesita el
+# wrapper de AR (ver cargo-recipe-ar-wrapper). Firefox 128 pide cbindgen >= 0.26; 0.27 cumple.
+name    = "cbindgen"
+version = "0.27.0"
+
+[source]
+tarball          = "https://github.com/mozilla/cbindgen/archive/refs/tags/0.27.0.tar.gz"
+sha256           = "dd813d37325d21cd6be807be4f902a5ef130567cb4da17ea743206a3ebeb6303"
+strip_components = 1
+
+[build]
+compiler = "gcc"        # convención de las CLIs Rust: gcc = toolchain del link zig-cc
+target   = "x86_64-linux-musl"
+link     = "static"
+
+[deps]
+build = []
diff --git a/recipes/incoming-gnome/nasm.toml b/recipes/incoming-gnome/nasm.toml
new file mode 100644
index 00000000..f047e0aa
--- /dev/null
+++ b/recipes/incoming-gnome/nasm.toml
@@ -0,0 +1,22 @@
+# nasm — ensamblador x86. Herramienta de BUILD de mozjs (algunas rutas de código generan .asm) y de
+# varias libs de media más adelante. No está en el rootfs Alpine ni tenía receta. C plano, autotools.
+name    = "nasm"
+version = "2.16.03"
+
+[source]
+tarball          = "https://www.nasm.us/pub/nasm/releasebuilds/2.16.03/nasm-2.16.03.tar.xz"
+sha256           = "1412a1c760bbd05db026b6c0d1657affd6631cd0a63cddb6f73cc6d4aa616148"
+strip_components = 1
+
+[build]
+compiler = "gcc"
+target   = "x86_64-linux-musl"
+link     = "static"     # binario de herramienta: estático, sin runtime que arrastrar
+
+[build.phases]
+configure = "./configure --build=$CBUILD --host=$CHOST --prefix=/usr"
+compile   = "make -j\"$(nproc)\""
+install   = "make DESTDIR=/out install"
+
+[deps]
+build = ["make"]
diff --git a/recipes/incoming-gnome/nspr.toml b/recipes/incoming-gnome/nspr.toml
new file mode 100644
index 00000000..703b7669
--- /dev/null
+++ b/recipes/incoming-gnome/nspr.toml
@@ -0,0 +1,24 @@
+# nspr — Netscape Portable Runtime. Dep dura de mozjs/spidermonkey (hilos, IO, atómicos portables).
+# Build autotools clásico. El tarball extrae a nspr-4.36/nspr/configure ⇒ con strip_components=1 queda
+# `nspr/`, así que las fases entran a ese subdir. Alternativa si molesta: mozjs puede construir su nspr
+# in-tree (--enable-nspr-build); acá lo hacemos aparte porque NSS y otros también lo van a querer.
+name    = "nspr"
+version = "4.36"
+
+[source]
+tarball          = "https://ftp.mozilla.org/pub/nspr/releases/v4.36/src/nspr-4.36.tar.gz"
+sha256           = "55dec317f1401cd2e5dba844d340b930ab7547f818179a4002bce62e6f1c6895"
+strip_components = 1
+
+[build]
+compiler = "gcc"        # C plano con gcc-ismos en el configure; sigue el patrón de linux-pam
+target   = "x86_64-linux-musl"
+link     = "dynamic"    # mozjs detecta libnspr4.so vía nspr-config/pkg-config
+
+[build.phases]
+configure = "cd nspr && ./configure --build=$CBUILD --host=$CHOST --prefix=/usr --libdir=/usr/lib --enable-optimize --disable-debug --enable-64bit"
+compile   = "cd nspr && make -j\"$(nproc)\""
+install   = "cd nspr && make DESTDIR=/out install"
+
+[deps]
+build = ["make"]
diff --git a/recipes/incoming-gnome/spidermonkey.toml b/recipes/incoming-gnome/spidermonkey.toml
new file mode 100644
index 00000000..d7bc4606
--- /dev/null
+++ b/recipes/incoming-gnome/spidermonkey.toml
@@ -0,0 +1,37 @@
+# spidermonkey (mozjs 128 ESR) — el motor JavaScript de Mozilla. KEYSTONE del frente GNOME: gjs cuelga
+# de él, y gnome-shell cuelga de gjs. Es de lo más DIFÍCIL que hay en cualquier distro.
+#
+# ⚠ PRIMER BORRADOR — NO va a sellar a la primera. mozjs sobre musl nunca compila de un saque; el
+# sistema de build de Mozilla (mach/configure) NO es uno de los auto-detectados por el lab, así que las
+# fases van A MANO y hay que ITERARLAS EN EL WORKER (ccx33 o mayor: el compile C++ come ~8GB+ y quiere
+# swap; ccx23 va justo). Anclado al APKBUILD de mozjs128 de Alpine (misma libc musl). Decisiones:
+#   · Fuente = tarball del SOURCE de Firefox 128.14.0esr (mozjs se construye desde js/src de ese árbol).
+#   · clang (el rootfs trae LLVM 22); mozjs prefiere clang fuerte a gcc.
+#   · icu IN-TREE (--without-system-icu): evita casar versiones de un icu del sistema (una dep menos).
+#   · nspr y zlib del sistema (recetas nspr + zlib del corpus).
+#   · shared-js (libmozjs-128.so) — lo que gjs enlaza.
+# Cosas que MUY probablemente haya que tocar al iterar: el nombre exacto del build dir/mach vs configure,
+# --enable-release/--enable-hardening, flags de linker (lld), y RUST/CBINDGEN en PATH. Cuando selle en
+# el worker, se congela el hash y se promueve.
+name    = "spidermonkey"
+version = "128.14.0"
+
+[source]
+tarball          = "https://ftp.mozilla.org/pub/firefox/releases/128.14.0esr/source/firefox-128.14.0esr.source.tar.xz"
+sha256           = "93b9ef6229f41cb22ff109b95bbf61a78395a0fe4b870192eeca22947cb09a53"
+strip_components = 1
+
+[build]
+compiler = "clang"
+target   = "x86_64-linux-musl"
+link     = "dynamic"
+
+[build.phases]
+# MOZBUILD_STATE_PATH/MOZ_NOSPAM: mach escribe estado y telemetría; los fijamos a /tmp y los callamos.
+# Se construye en un obj-dir separado dentro de js/src (idioma de mozjs). CC/CXX=clang explícitos.
+configure = "export MOZBUILD_STATE_PATH=/tmp/.mozbuild MOZ_NOSPAM=1 SHELL=/bin/sh PYTHON=python3 && cd js/src && mkdir -p obj && cd obj && CC=clang CXX=clang++ AR=llvm-ar ../configure --prefix=/usr --host=$CHOST --target=$CHOST --disable-debug --enable-optimize --enable-release --enable-hardening --disable-jemalloc --enable-shared-js --disable-tests --without-system-icu --with-system-nspr --with-system-zlib"
+compile   = "cd js/src/obj && make -j\"$(nproc)\""
+install   = "cd js/src/obj && make DESTDIR=/out install"
+
+[deps]
+build = ["nspr", "nasm", "cbindgen", "python3", "make", "zlib", "pkgconf"]