The mover keeps the record.
Everything that moves physically is tracked by the company being paid to move it. A scan is a claim. A delivery is a claim. The rate printed on the label is a claim about a price that will not settle for weeks, after the parcel has been reweighed by the party doing the billing. Nowhere in the chain is there a second reading, so the description is the state, and every system downstream acts on it as though it had been measured.
That is not fraud and it does not need to be. One record, one author, and the author is an interested party. The errors do not have to be deliberate to all lean the same way.
EasyPost, Shippo and ShipEngine turned a hundred carrier APIs into one. That is real work and it is close to finished: the plurality of interfaces is a solved problem, and nobody should solve it again.
The plurality of accounts it left exactly where it found it. What comes back is still the carrier's version of events, in a better shape, held in a system that is not yours to open. Nothing in that arrangement can tell you the quote was wrong, because the quote is the only thing it ever saw.
A description separates from the system it describes in three places: at the edge of the range, over time, and downstream of a change that looked local. Below is each one simulated on this system, with illustrative numbers. Operate them.
The edge. A carrier's committed daily capacity is a number in a contract. Tender past it and nothing rejects. It keeps accepting, then stops moving, and the parcels sit scanned-in at a hub with no exception raised. You find the real ceiling by hitting it.
Time. The quote at label-buy is correct on the day. The invoice arrives weeks later carrying reweighs, re-dimensions and surcharges, and almost nobody reconciles it line by line, so the gap is real, compounding, and unobserved.
Downstream. The parcel is unchanged and the carrier is not wrong about anything. One field goes missing from one event, and the webhook, the warehouse, the order status and the ledger have all already acted on it before anyone reads the exception.
Whether a second reading is cheap enough to keep. The carrier's scan costs nothing and ours does not. If the readings cost more than the drift they expose, the argument fails, and we would rather find that out early than argue it.
We also do not know how much of the gap is recoverable once it is visible. Seeing that an invoice is wrong and getting it corrected are different problems, and only the first one is ours.
An open shipping layer, in Rust. It does everything an aggregator does: rates, labels, tracking, one interface over many carriers. Then it keeps your readings next to the carrier's, quoted against invoiced, promised against scanned, scanned against what you observed. One record, held by you, with both authors in it.
Open source is the mechanism here rather than the politics. A record you cannot inspect is another claim, and we would only have added one.