The OTP bugs we inherit are rarely in the code generation itself. They sit in the state around it: cooldowns per channel, attempt counters that reset on resend, lockout that quietly never fires.
Swap SMS for email and the invariants should hold. If they move, your state machine probably lives in the wrong place.
Worth checking where yours lives. https://shipmindlabs.com/c/c8269d48