diff --git a/UPSTREAM_DIFF.md b/UPSTREAM_DIFF.md
index 7e7d390..79070f6 100644
--- a/UPSTREAM_DIFF.md
+++ b/UPSTREAM_DIFF.md
@@ -1,44 +1,38 @@
 # Upstream API Diff
 
-> Old routes: 36 · New routes: 58
+> Bumping `@photon-ai/dashboard-api` from 1.6.12 → 1.6.17 (dashboard@v1.6.17).
+> Spans upstream releases v1.6.13, v1.6.14, v1.6.15, v1.6.16, v1.6.17.
 
 ## Added Routes
 
 | Route | Method |
 |-------|--------|
-| `api.profile.spectrum-updates` | `PATCH` |
-| `api.projects.:id.members` | `GET` |
-| `api.projects.:id.members` | `POST` |
-| `api.projects.:id.members.:memberUserId` | `DELETE` |
-| `api.projects.:id.slack` | `DELETE` |
-| `api.projects.:id.slack` | `GET` |
-| `api.projects.:id.slack` | `PUT` |
-| `api.projects.:id.slack.installations` | `GET` |
-| `api.projects.:id.slack.installations.:teamId` | `DELETE` |
-| `api.projects.:id.spectrum.avatar` | `DELETE` |
-| `api.projects.:id.spectrum.avatar.commit` | `POST` |
-| `api.projects.:id.spectrum.avatar.upload` | `POST` |
-| `api.projects.:id.voice.imessage-enabled` | `PATCH` |
-| `api.projects.:id.voice.settings` | `GET` |
-| `api.projects.:id.voice.sip-inbound` | `DELETE` |
-| `api.projects.:id.voice.sip-inbound` | `PATCH` |
-| `api.projects.:id.webhooks` | `GET` |
-| `api.projects.:id.webhooks` | `POST` |
-| `api.projects.:id.webhooks.:webhookId` | `DELETE` |
-| `api.projects.:id.whatsapp.templates` | `GET` |
-| `api.projects.:id.whatsapp.templates` | `POST` |
-| `api.projects.:id.whatsapp.templates.:templateId` | `DELETE` |
-| `api.projects.:id.whatsapp.templates.:templateId` | `PATCH` |
+| `api.otp.phone2.send` | `POST` |
+
+`api.otp.phone2.send` is the real phone-OTP send path (dashboard#259). The
+pre-existing `api.otp.phone.send` remains as a decoy honeypot for scraped
+clients. The CLI does not call either route.
 
 ## Removed Routes
 
-| Route | Method |
-|-------|--------|
-| `api.projects.:id.spectrum.avatar-upload-url` | `GET` |
+_(none)_
+
+## Changed Routes
+
+| Route | Method | Change |
+|-------|--------|--------|
+| `api.projects.:id` | `GET` | Response body adds `avatarUrl: string \| null`, `plan: PlanTier`, `platforms: SpectrumPlatformId[]`, `userCount: number` (dashboard#255). |
+
+Surfaced in `photon projects show` as new `plan`, `platforms`, `userCount`
+rows between `location` and `owner`. `avatarUrl` is intentionally not printed
+— the CLI can't render images and it's redundant with `spectrum avatar`.
+
+The `api.otp.phone.send` body field order swapped `code`/`captchaToken`
+cosmetically; both fields are still present and optional/required as before.
 
 ## Summary
 
-- **23** added
-- **1** removed
-- **0** changed
-- **35** unchanged
+- **1** added
+- **0** removed
+- **1** changed (additive fields on `GET /api/projects/:id`)
+- Server-side only (no CLI impact): dashboard#250 (>3-dot email local-part signup block, v1.6.13), dashboard#251 phone-OTP suspension (v1.6.14), dashboard#256 suspended-user redirect (v1.6.14), dashboard#257 email-domain OTP abuse controls (v1.6.14), dashboard#258 signup IP suspensions (v1.6.15), dashboard#260 log real phone sends after three OTP failures (v1.6.16), dashboard#261 block suspicious OTP IPs for seven days (v1.6.17).
diff --git a/bun.lock b/bun.lock
index 57ccf69..8dc7ecc 100644
--- a/bun.lock
+++ b/bun.lock
@@ -17,7 +17,7 @@
         "update-notifier": "^7.3.1",
       },
       "devDependencies": {
-        "@photon-ai/dashboard-api": "1.6.12",
+        "@photon-ai/dashboard-api": "1.6.17",
         "@types/bun": "latest",
         "@types/node": "^25.6.2",
         "@types/semver": "^7.7.1",
@@ -52,7 +52,7 @@
 
     "@noble/hashes": ["@noble/hashes@2.2.0", "", {}, "sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg=="],
 
-    "@photon-ai/dashboard-api": ["@photon-ai/dashboard-api@1.6.12", "", { "peerDependencies": { "@elysiajs/eden": "^1.4.9", "elysia": "^1.4.28" } }, "sha512-CxUyvSpJmi5dn3razikiD8xw6l1YN3dflRlBghukV/fYIQaSL25UNJpaBYjdX8Qj0ka4+/RLJoloBdQdUTstmA=="],
+    "@photon-ai/dashboard-api": ["@photon-ai/dashboard-api@1.6.17", "", { "peerDependencies": { "@elysiajs/eden": "^1.4.9", "elysia": "^1.4.28" } }, "sha512-jRLvfLSTKSPQId4WyOZx8HMReApcPui3MHOGU8/cYu147JHMWuVOPrmymoc64V1AD7/Z9CjohYSqi1M1y6vdXg=="],
 
     "@pnpm/config.env-replace": ["@pnpm/config.env-replace@1.1.0", "", {}, "sha512-htyl8TWnKL7K/ESFa1oW2UB5lVDxuF5DpM7tBi6Hu2LNL3mWkIzNLG6N4zoCUP1lCKNxWy/3iu8mS8MvToGd6w=="],
 
diff --git a/package.json b/package.json
index 266bc92..cefd8b7 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "prepublishOnly": "bun run typecheck && bun run build"
   },
   "devDependencies": {
-    "@photon-ai/dashboard-api": "1.6.12",
+    "@photon-ai/dashboard-api": "1.6.17",
     "@types/bun": "latest",
     "@types/node": "^25.6.2",
     "@types/semver": "^7.7.1",
diff --git a/src/commands/projects.ts b/src/commands/projects.ts
index bef32b8..f455281 100644
--- a/src/commands/projects.ts
+++ b/src/commands/projects.ts
@@ -134,6 +134,9 @@ function registerShowCommand(projects: Command): void {
       printKv([
         ["status", formatStatus(p.status)],
         ["location", p.location],
+        ["plan", p.plan],
+        ["platforms", p.platforms.length > 0 ? p.platforms.join(", ") : c.dim("—")],
+        ["userCount", String(p.userCount)],
         ["owner", p.isOwner ? c.green("yes") : c.dim("no")],
         ["template", p.template ? "yes" : "no"],
         ["observability", p.observability ? "yes" : "no"],