diff --git a/UPSTREAM_DIFF.md b/UPSTREAM_DIFF.md
index 7e7d390..df1515b 100644
--- a/UPSTREAM_DIFF.md
+++ b/UPSTREAM_DIFF.md
@@ -1,44 +1,37 @@
 # Upstream API Diff
 
-> Old routes: 36 · New routes: 58
+Sync range: `@photon-ai/dashboard-api` **1.6.12 → 1.6.21** (dashboard@v1.6.21).
 
 ## Added Routes
 
 | Route | Method |
 |-------|--------|
-| `api.profile.spectrum-updates` | `PATCH` |
-| `api.projects.:id.members` | `GET` |
-| `api.projects.:id.members` | `POST` |
-| `api.projects.:id.members.:memberUserId` | `DELETE` |
-| `api.projects.:id.slack` | `DELETE` |
-| `api.projects.:id.slack` | `GET` |
-| `api.projects.:id.slack` | `PUT` |
-| `api.projects.:id.slack.installations` | `GET` |
-| `api.projects.:id.slack.installations.:teamId` | `DELETE` |
-| `api.projects.:id.spectrum.avatar` | `DELETE` |
-| `api.projects.:id.spectrum.avatar.commit` | `POST` |
-| `api.projects.:id.spectrum.avatar.upload` | `POST` |
-| `api.projects.:id.voice.imessage-enabled` | `PATCH` |
-| `api.projects.:id.voice.settings` | `GET` |
-| `api.projects.:id.voice.sip-inbound` | `DELETE` |
-| `api.projects.:id.voice.sip-inbound` | `PATCH` |
-| `api.projects.:id.webhooks` | `GET` |
-| `api.projects.:id.webhooks` | `POST` |
-| `api.projects.:id.webhooks.:webhookId` | `DELETE` |
-| `api.projects.:id.whatsapp.templates` | `GET` |
-| `api.projects.:id.whatsapp.templates` | `POST` |
-| `api.projects.:id.whatsapp.templates.:templateId` | `DELETE` |
-| `api.projects.:id.whatsapp.templates.:templateId` | `PATCH` |
+| `api.captcha.provider` | `GET` |
+| `api.otp.phone2.send` | `POST` |
 
 ## Removed Routes
 
-| Route | Method |
-|-------|--------|
-| `api.projects.:id.spectrum.avatar-upload-url` | `GET` |
+_(none)_
+
+## Changed Routes
+
+| Route | Method | Change |
+|-------|--------|--------|
+| `api.projects.:id` | `GET` | Response body gains `avatarUrl: string \| null`, `plan: PlanTier`, `platforms: SpectrumPlatformId[]`, `userCount: number` |
+| `api.otp.phone2.send` | `POST` | Body gains optional `browserId?: string` (v1.6.21) |
+| `api.otp.phone.send` | `POST` | Cosmetic field-order swap in decoy body (`code` / `captchaToken`) |
 
 ## Summary
 
-- **23** added
-- **1** removed
-- **0** changed
-- **35** unchanged
+- **2** added
+- **0** removed
+- **3** changed
+- rest unchanged
+
+## Notes per release
+
+- **v1.6.13** — no-op (dashboard#250, signup dot-limit; server-side only)
+- **v1.6.14** — additive: project-detail response gains `avatarUrl`, `plan`, `platforms`, `userCount` (dashboard#255). Surfaced in `photon projects show`.
+- **v1.6.15** — additive: `POST /api/otp/phone2/send` route added (dashboard#259). CLI never touches OTP routes; no code change required.
+- **v1.6.16 – v1.6.20** — no-ops: server-side OTP / captcha routing changes (dashboard#260–#266). No route or DTO change.
+- **v1.6.21** — additive: `browserId?: string` added to `POST /api/otp/phone2/send` body (dashboard#267, browser-aware phone OTP abuse gate). Server-side auth flow; CLI does not call this route.
diff --git a/bun.lock b/bun.lock
index 57ccf69..7018b4a 100644
--- a/bun.lock
+++ b/bun.lock
@@ -17,7 +17,7 @@
         "update-notifier": "^7.3.1",
       },
       "devDependencies": {
-        "@photon-ai/dashboard-api": "1.6.12",
+        "@photon-ai/dashboard-api": "1.6.21",
         "@types/bun": "latest",
         "@types/node": "^25.6.2",
         "@types/semver": "^7.7.1",
@@ -52,7 +52,7 @@
 
     "@noble/hashes": ["@noble/hashes@2.2.0", "", {}, "sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg=="],
 
-    "@photon-ai/dashboard-api": ["@photon-ai/dashboard-api@1.6.12", "", { "peerDependencies": { "@elysiajs/eden": "^1.4.9", "elysia": "^1.4.28" } }, "sha512-CxUyvSpJmi5dn3razikiD8xw6l1YN3dflRlBghukV/fYIQaSL25UNJpaBYjdX8Qj0ka4+/RLJoloBdQdUTstmA=="],
+    "@photon-ai/dashboard-api": ["@photon-ai/dashboard-api@1.6.21", "", { "peerDependencies": { "@elysiajs/eden": "^1.4.9", "elysia": "^1.4.28" } }, "sha512-zMXxlsjJWbdJ9KxTNnercwiwkcjdTueD3iIylXtyRt3DDv69addSX8vBfgL8RjeFkY6lx/B/pbCK+i9bvDWEcg=="],
 
     "@pnpm/config.env-replace": ["@pnpm/config.env-replace@1.1.0", "", {}, "sha512-htyl8TWnKL7K/ESFa1oW2UB5lVDxuF5DpM7tBi6Hu2LNL3mWkIzNLG6N4zoCUP1lCKNxWy/3iu8mS8MvToGd6w=="],
 
diff --git a/package.json b/package.json
index 266bc92..1ca1e8d 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "prepublishOnly": "bun run typecheck && bun run build"
   },
   "devDependencies": {
-    "@photon-ai/dashboard-api": "1.6.12",
+    "@photon-ai/dashboard-api": "1.6.21",
     "@types/bun": "latest",
     "@types/node": "^25.6.2",
     "@types/semver": "^7.7.1",