Overview. TOTP is pretty simple and is described pretty well in the RFC you linked to again. You might want to read through the RFC another time: it's all there. I'm going to summarize the RFC for you, but you could have gotten all of this yourself by reading the RFC.
Time steps. For example, you asked about what is a timestamp vs a time step. The first two paragraphs of Section 4.2 define these terms. As it says there, T is the number of time steps between the initial counter time T0 and the current Unix time. X is the size of the time step, e.g., 30 seconds. See the third paragraph of Section 4.2 of the RFC for an example.
Resynchronization. Section 6 describes how resynchronization works. Read that section for details.
For instance, suppose the client thinks that the current time is 10:01:20 (i.e., 1 minute and 20 seconds after 10 o'clock), and the server thinks that the current time is 10:02:07. In other words, the server's clock will be 47 seconds forward from the client's. Let's say for simplicity that the initial time is 10:00:00 (in practice it will be much farther back in the past, but I want to keep the numbers small here), and the time step is 30 seconds. The client will calculate T as the number of time steps from the starting point, i.e., T = floor(80/30) = 2. The client will generate a one-time password as HOTP(K, 2). However, the server's time is different, so the server will compute T' = floor(127/30) = 4, and the server will be expecting the one-time password HOTP(K, 4). The client's password will not match what the server is expecting.
If the client's one-time password does not match HOTP(K, T'), then the server also checks whether it matches HOTP(K, T'-1) and HOTP(K, T'-2). In our example above, the client's one-time password does match HOTP(K, T'-2), so the server allows the client to log in successfully. The server can also tell that the client's clock is about 2 time steps behind the server's, so the server can update its records for that client. When the client next tries to log in, the server will compute T' based upon an adjusted version of its own clock, adjusted for its estimate of the clock skew.
This is pretty straightforward and standard stuff, and is all explained in Section 6.
Discussion and caveats. What are you using one-time passwords for? Be warned that they have a number of drawbacks. Their most severe limitations is that they are not secure against man-in-the-middle attacks, they are not secure against client-side malware, and they are not secure against phishing attacks.
You might want to consider other means of user authentication, and re-consider whether one-time passwords are the best solution to your particular problem. The method that is best for you will depend upon your particular application.
