Does R need to be cleared here as well, since it's derived from k? If not, why?

R is public so it should be fine.

(technically, the jacobi index of Y is one additional bit of private information that is normally erased before publication, however this bit does not have a connection that can lead to compromise of private key since it is uncorrelated with the rest of the nonce)

jacobi symbol i mean

Interesting that this sign flip trick still works with MuSig. If signers produce an aggregate R that needs to have its sign flipped, then all signers can individually notice this, flip their k's, and thereby arrive at the proper result.

Yes.

There was something bothering me about the way the k argument gets mutated here and I realized what it was... basically, if you were to call this function a second time with same variables, it may produce the wrong signature. In principle maybe you ought to flip the sign of R as well so that the caller learns the new corrected R.

But meh, as long as it's clear that k is expected to be cleared immediately after and no second call, it doesn't matter.

The function is secp256k1_schnorr_compute_sig, not secp256k1_schnorr_compute_R

Should this also sanity-check the pubkey point argument (not point at infinity)?

Alternatively if sanity checks are not needed, this function can return void.

OK, so it can be cleared in secp256k1_schnorr_sig_sign

Same comment as below -- why sanity check the private key but not also sanity-check the pubkey point argument (not point at infinity)?

That function never use it, so there is really no point doing it here.