Take out the two programs a go build in place committed, and refuse any compiled program in the tree in the catalogue's check (issue 1126): the second of the kind in a day

.gitignore

@@ -34,3 +34,5 @@ modules/mesh-build-image/cmd/mesh-build-image/mesh-build-image
 /checks/paths/paths
 /modules/mesh-build-go/mesh-build-go
 /modules/mesh-delivery-gate/mesh-delivery-gate
+modules/mesh-config/cmd/mesh-config/mesh-config
+checks/placement/placement

checks/noscripts/noscripts_test.go

@@ -1,12 +1,21 @@
 package noscripts
 
 import (
+	"bytes"
 	"errors"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"testing"
 )
 
+// builtKnown are the compiled programs tracked on main the day the refusal below began (2026-10-26), each to be removed
+// from the tree; the list only shrinks.
+var builtKnown = map[string]bool{
+	"modules/forticlient/cmd/forticlient-tools/forticlient-tools": true,
+	"modules/networkmanager/uplink-tools":                         true,
+}
+
 // The catalogue's checks are Go tests (novox/hq ADR 0529 clause 5, ADR 0445): the checker runs every nested Go module's tests by
 // the language's convention and no script at the root says what else to run. A script back at the root would be a check nobody
 // runs (ADR 0503 §3: since R4e the checker has not run them), so it is refused.
@@ -16,4 +25,27 @@ func TestNoScriptOfTheOldCheckStandsAtTheRoot(t *testing.T) {
 			t.Errorf("%s stands at the catalogue's root (%v): what it ran is a Go test in checks/ or a step of the build module", name, err)
 		}
 	}
+
+	// Nor does a compiled program stand in the tree (issue 1126: a `go build` in place committed twice in one day, 5 and
+	// 6 MB each, which only a rewrite of the branch takes out of its history): the build module builds what runs.
+	out, err := exec.Command("git", "-C", filepath.Join("..", ".."), "ls-files", "-z").Output()
+	if err != nil {
+		t.Fatalf("the tracked files cannot be listed, so no compiled program can be refused: %v", err)
+	}
+	for _, name := range bytes.Split(bytes.TrimRight(out, "\x00"), []byte{0}) {
+		f, err := os.Open(filepath.Join("..", "..", string(name)))
+		if err != nil {
+			continue // a tracked file the checkout lacks (deleted, not yet committed)
+		}
+		magic := make([]byte, 4)
+		n, _ := f.Read(magic)
+		f.Close()
+		if n == 4 && string(magic) == "\x7fELF" && !builtKnown[string(name)] {
+			t.Errorf("%s is a compiled program: remove it with git rm --cached, and build with -o outside the tree", name)
+		}
+		delete(builtKnown, string(name))
+	}
+	for name := range builtKnown {
+		t.Errorf("%s is no longer tracked: take it off builtKnown", name)
+	}
 }