diff --git a/CHANGELOG.md b/CHANGELOG.md
index 15e2ae2..48cd5c3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,12 @@
 All notable changes to Void 2.0 are documented here.
 Format: [Keep a Changelog](https://keepachangelog.com).
 
+## 2.0.0-alpha.27
+- feat: Timelapse + AI Usage folded into the left rail as an "Apps" section,
+  embedded as cross-origin HTTPS iframes; each stays chromeless at its own URL.
+- feat: phuryn usage dashboard now reachable at aiusage.hynesy.com behind CF Access.
+- feat: Sacred Valley AI Usage card opens the in-Void #/ai-usage route.
+
 ## 2.0.0-alpha.23 — Local/remote-aware service tiles
 - **Optional `external` URL per service** (`migration 022`, `config/services.json`, repo + `/api/health/services` payload + `svcBody`): Little Blue health-band tiles previously linked to the single LAN `url`, so they opened dead private IPs when browsing remotely (e.g. Gramps `http://192.168.1.99`). Migration adds the column and **backfills** curated domains by id (the live instance is already seeded, so a column-add alone wouldn't populate them); also normalises `jellyfin`/`chaptarr` (which stored a domain in `url`) to LAN `url` + `external`.
 - **Context-based tile target + one-click alt** (`public/views/service_url.js`, `public/components/service_tile.js`, `public/views/health_band.js`): the tile picks its primary URL from `location.hostname` — public host (e.g. `void.hynesy.com`) opens the domain, private IP/localhost/.local opens the LAN address — and always offers a `⇄` alt to the *other* URL (a reliable manual fallback; an auto-probe can't work because an HTTPS dashboard is blocked from probing `http://` LAN IPs by mixed-content). Services with no `external` are dimmed with a "LAN-only" badge when remote. Tile root is now a `div` with a stretched primary `<a>` + sibling alt `<a>` (no nested anchors). Health checker unchanged (still probes LAN `url` from CT 311).
diff --git a/package.json b/package.json
index 0894ddf..15551c2 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "void-server",
-  "version": "2.0.0-alpha.23",
+  "version": "2.0.0-alpha.27",
   "type": "module",
   "private": true,
   "scripts": {
diff --git a/server.js b/server.js
index 547def8..1168654 100644
--- a/server.js
+++ b/server.js
@@ -13,7 +13,7 @@ import { mcpAuth } from './lib/api/middleware/mcp_auth.js';
 import { handleMcp } from './lib/mcp/http.js';
 import httpProxy from 'http-proxy';
 
-const VERSION = '2.0.0-alpha.23';
+const VERSION = '2.0.0-alpha.27';
 
 // Proxy /terminal (+ its WebSocket) to ttyd on CT 300, so the embedded terminal
 // works whether the Void is reached via Traefik (void2-app.hynesy.com) OR the