OTP platform design 1 question in 2 chapters

I first separate delivered verification codes from authenticator-generated time-based passwords. For a delivered code, I create a short-lived challenge bound to a user, purpose and login attempt. Verification atomically checks expiry, counts failed attempts and consumes a match once. I rate-limit both sending and guessing across instances, protect the code in storage and logs, and handle delayed delivery and retries without issuing extra valid challenges.