Reading it again I don't think the HOTP RFC says anything about the lower bound actually.

> Implementations MUST extract a 6-digit code at a minimum and possibly 7 and 8-digit code.

I think it's actually saying that the *upper bound* MUST be at least 6?

We should probably mention OCRA in the docs somewhere what with it defining extra stuff about HOTP.