GitHub 2FA challenge step, GitLab account-recovery flow, and many enterprise IdPs that present the TOTP field alongside a fallback "Use a backup code" field.
Pattern
Two visible inputs in the same form. TOTP: name="totp", autocomplete="one-time-code". Recovery: name="backup_code", label "Backup recovery code".
Hits
TOTP field: strict vocab + one-time-code. Recovery field: would match Ambiguous ("code") but is excluded via RecoveryCodeFieldNames (backup).
Expected
Extension fills the TOTP field and leaves the recovery field untouched, on both manual and page-load triggers.
Purpose
Regression bar for the recovery-code exclusion guard. A TOTP code written into the backup-code field would be a bad outcome.
Two-factor authentication
Enter your authenticator code, or use a backup code if you can't access your device