On a follower, a layered cursor modify that routes to ingest (_clayered_modify_ingest) writes through either the ingest cursor's raw modify() or a full-value update() fallback. Both paths bypass _clayered_put_constituent, so neither checks the truncate list for range conflicts.

As a result, a modify can succeed on a key covered by an uncommitted truncate range, or by a committed range that is invisible to the writer. This includes stable-only keys, where ingest holds no tombstone for the normal write-conflict check to find. Insert, update, remove and reserve all check the truncate list; modify does not.

Fix: run the truncate-list conflict check before either modify write path, while the writer holds the truncate-list read lock across check and update installation.

Tests: cover both the raw modify path and the full-value fallback, against a pending truncate and against a committed truncate invisible to the writer, including a stable-only key.