About the "validity" period: in practice it seems to be more like a rotation period, the code themselves seem to be valid longer than this, that is you can often enter them for quite some time after they get rotated.
And I also often wonder about the OTP aspect, whether there is any protection in TOTP backends for the same TOTP being used twice.
And I also often wonder about the OTP aspect, whether there is any protection in TOTP backends for the same TOTP being used twice.