The same pgtype unwrap-and-fill block (sync_enabled/auto_sync validity, frequency fallback, pointer timestamps) existed at five DeviceInfo construction sites, two of which also carried AuthToken. deviceToInfo(device, includeAuthToken) replaces all five; token-bearing lists pass the flag explicitly so the surface that exposes the token stays a deliberate choice.