Short answer: verify the phone challenge as a short-lived, single-use authentication event, then record enough metadata to show what happened without storing the code itself. For a logistics portal that emails a generated report, that means the SMS check protects access to the report and the audit record proves the decision. Delivery is only one part of the system.

The useful design boundary is small: create a challenge, bind it to a login attempt and a phone number, send a code through an abstract provider interface, and consume the challenge atomically after a successful comparison. Keep the report attachment out of the SMS path. A delayed text must not cause a second report to be generated, and a report failure must not make a valid phone verification look invalid.

That distinction matters.

What must the verification record prove?

In a warehouse or carrier portal, an operator may request a generated delivery report and receive it as an email attachment.…