As I was re-reading the xonly method I noticed that the author had taken some care about the magnitude of g in each branch. It’s probably worth documenting magnitude assumptions when control flows join like this.
Actually I would even prefer a new field method (perhaps _fe_join) that calls SECP256K1_FE_VERIFY_MAGNITUDE, and then sets the magnitude to that value. That would be more in line with the static analysis view of magnitudes that I recall being discussed, though I have not been following closely lately.
