Modal and Cloudflare sandbox runs come back without the isolation tier their docs describe

The two services the author checked show different gaps. Cloudflare documents a single tier for the whole product, so if that statement is true, the sentence in its docs already covers every run ^[3]. Modal puts two tiers behind one create call and lets the caller choose with a flag ^[4]. The author wrote of Modal: "Nothing in what comes back tells you which of the two served a particular call." ^[5] In our view the per-call value matters most in that second case.

The six-service result is plimsoll's own reading of current documentation in September 2026 ^[14]. The project making the claim also ships the feature it says is missing ^[6]. The dev.to author wrote, "I checked two of those myself instead of taking the claim on faith." ^[2] That leaves E2B, Daytona, Vercel Sandbox and Northflank resting on plimsoll's reading alone ^[13]. The post does not show a response payload from any of the four, or a case where a provider ran code below the tier requested.

A minimum tier is only useful if a refusal is legible. An InvalidArgument error typically means validation rejected the request, yet a worker can also refuse once its container is already running, and a capacity refusal can come from the daemon's limiter or from the provider ^[12]. So plimsoll marks refusals raised before dispatch with a reason, and treats an unmarked refusal as "may have executed" ^[7]. We think that default is right, because a code path that forgot to mark its error then cannot pass for a safe retry.

The mark also depends on the request ID. Every request carries a new 32-hex-digit ID from the client, and the daemon repeats it back ^[8]. Without the echo, a confused proxy could serve one request's answer for another, and the retry would run the code twice.

The record side is built with the same caution. The daemon holds no signing key, since it runs hostile code and a single engine escape would otherwise put forgery of every record within one key's reach ^[10]. Signing happens in a separate harness outside the daemon. It recomputes the digests from its own copy and signs only the digests that match. In the cart-pole example, the same run on five providers, four of them different backends, hashed to one value ^[11].