diff --git a/UPSTREAM_DIFF.md b/UPSTREAM_DIFF.md
index 7e7d390..b2e0216 100644
--- a/UPSTREAM_DIFF.md
+++ b/UPSTREAM_DIFF.md
@@ -1,44 +1,24 @@
-# Upstream API Diff
+# Upstream API Diff — dashboard@v1.6.19
 
-> Old routes: 36 · New routes: 58
+Bump `@photon-ai/dashboard-api` 1.6.12 → 1.6.19.
 
-## Added Routes
+## Changes since 1.6.12
 
-| Route | Method |
-|-------|--------|
-| `api.profile.spectrum-updates` | `PATCH` |
-| `api.projects.:id.members` | `GET` |
-| `api.projects.:id.members` | `POST` |
-| `api.projects.:id.members.:memberUserId` | `DELETE` |
-| `api.projects.:id.slack` | `DELETE` |
-| `api.projects.:id.slack` | `GET` |
-| `api.projects.:id.slack` | `PUT` |
-| `api.projects.:id.slack.installations` | `GET` |
-| `api.projects.:id.slack.installations.:teamId` | `DELETE` |
-| `api.projects.:id.spectrum.avatar` | `DELETE` |
-| `api.projects.:id.spectrum.avatar.commit` | `POST` |
-| `api.projects.:id.spectrum.avatar.upload` | `POST` |
-| `api.projects.:id.voice.imessage-enabled` | `PATCH` |
-| `api.projects.:id.voice.settings` | `GET` |
-| `api.projects.:id.voice.sip-inbound` | `DELETE` |
-| `api.projects.:id.voice.sip-inbound` | `PATCH` |
-| `api.projects.:id.webhooks` | `GET` |
-| `api.projects.:id.webhooks` | `POST` |
-| `api.projects.:id.webhooks.:webhookId` | `DELETE` |
-| `api.projects.:id.whatsapp.templates` | `GET` |
-| `api.projects.:id.whatsapp.templates` | `POST` |
-| `api.projects.:id.whatsapp.templates.:templateId` | `DELETE` |
-| `api.projects.:id.whatsapp.templates.:templateId` | `PATCH` |
+- **1.6.13** — Server-side signup validation (dashboard#250, suspend signups with >3 email-local dots). No route/DTO change.
+- **1.6.14** — Additive fields on `GET /api/projects/:id` (dashboard#255): `avatarUrl`, `plan`, `platforms`, `userCount`. Surfaced by `photon projects show` (already on main).
+- **1.6.15** — Additive OTP route `POST /api/otp/phone2/send` (dashboard#259) plus old `POST /api/otp/phone/send` kept as decoy. Server-side signup IP suspensions (dashboard#258). No CLI impact — CLI never called `api.otp.*`.
+- **1.6.16** — Server-side logging on real phone OTP send after three failures (dashboard#260). No route/DTO change.
+- **1.6.17** — Server-side block list for suspicious OTP IPs for seven days (dashboard#261). No route/DTO change.
+- **1.6.18** — Server-side swap of OTP send captcha provider to Google reCAPTCHA (dashboard#262). No route/DTO change.
+- **1.6.19** — Add CAPTCHA method to phone OTP forensic logs (dashboard#263). No route/DTO change.
 
-## Removed Routes
+`diff -rq` on the bundled dist between 1.6.18 and 1.6.19 is empty, confirming no
+public API surface change in this release.
 
-| Route | Method |
-|-------|--------|
-| `api.projects.:id.spectrum.avatar-upload-url` | `GET` |
+## Added / Removed / Changed Routes
 
-## Summary
+_(none in 1.6.19)_
 
-- **23** added
-- **1** removed
-- **0** changed
-- **35** unchanged
+The cumulative 1.6.12 → 1.6.19 delta (additive project-detail fields in 1.6.14
+and additive OTP route in 1.6.15) is unchanged from the v1.6.18 sync and is
+already reflected on main.
diff --git a/bun.lock b/bun.lock
index 57ccf69..fb799b9 100644
--- a/bun.lock
+++ b/bun.lock
@@ -17,7 +17,7 @@
         "update-notifier": "^7.3.1",
       },
       "devDependencies": {
-        "@photon-ai/dashboard-api": "1.6.12",
+        "@photon-ai/dashboard-api": "1.6.19",
         "@types/bun": "latest",
         "@types/node": "^25.6.2",
         "@types/semver": "^7.7.1",
@@ -52,7 +52,7 @@
 
     "@noble/hashes": ["@noble/hashes@2.2.0", "", {}, "sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg=="],
 
-    "@photon-ai/dashboard-api": ["@photon-ai/dashboard-api@1.6.12", "", { "peerDependencies": { "@elysiajs/eden": "^1.4.9", "elysia": "^1.4.28" } }, "sha512-CxUyvSpJmi5dn3razikiD8xw6l1YN3dflRlBghukV/fYIQaSL25UNJpaBYjdX8Qj0ka4+/RLJoloBdQdUTstmA=="],
+    "@photon-ai/dashboard-api": ["@photon-ai/dashboard-api@1.6.19", "", { "peerDependencies": { "@elysiajs/eden": "^1.4.9", "elysia": "^1.4.28" } }, "sha512-v41q3wUPic29AUHAewGmxniHYFWj+2y8O2Z0TpRCk0ChcQIhPFWpIPSZCJIee7HkLeQvqLKm5f9Y4OPJhe47UA=="],
 
     "@pnpm/config.env-replace": ["@pnpm/config.env-replace@1.1.0", "", {}, "sha512-htyl8TWnKL7K/ESFa1oW2UB5lVDxuF5DpM7tBi6Hu2LNL3mWkIzNLG6N4zoCUP1lCKNxWy/3iu8mS8MvToGd6w=="],
 
diff --git a/package.json b/package.json
index 266bc92..b1d308d 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "prepublishOnly": "bun run typecheck && bun run build"
   },
   "devDependencies": {
-    "@photon-ai/dashboard-api": "1.6.12",
+    "@photon-ai/dashboard-api": "1.6.19",
     "@types/bun": "latest",
     "@types/node": "^25.6.2",
     "@types/semver": "^7.7.1",