diff --git a/.agents/docs/2026-07-12-add-tinyhttps-0.2.9-plan.md b/.agents/docs/2026-07-12-add-tinyhttps-0.2.9-plan.md
new file mode 100644
index 0000000..13ba8ad
--- /dev/null
+++ b/.agents/docs/2026-07-12-add-tinyhttps-0.2.9-plan.md
@@ -0,0 +1,29 @@
+# mcpplibs.tinyhttps 0.2.9 index update
+
+## Scope
+
+- Add upstream Form A module release `mcpplibs.tinyhttps@0.2.9` for Linux, macOS, and Windows.
+- Mirror the immutable GitHub tag archive byte-for-byte to `mcpp-res/tinyhttps`.
+- Add a three-platform module smoke example that compiles and runs exported request, proxy, response, and strict chunk-size APIs without external network access.
+
+## Release and source evidence
+
+- Upstream release: `https://github.com/mcpplibs/tinyhttps/releases/tag/0.2.9`
+- Tag commit: `965d805050d02fd6ed244473a6a68b6ace4bf032`
+- GLOBAL URL: `https://github.com/mcpplibs/tinyhttps/archive/refs/tags/0.2.9.tar.gz`
+- CN URL: `https://gitcode.com/mcpp-res/tinyhttps/releases/download/0.2.9/tinyhttps-0.2.9.tar.gz`
+- SHA256: `b17e0b15d2c205a2918708bcd3ac992384f1a38d03232c28f17190a1db081e54`
+
+The GLOBAL archive was downloaded independently twice and both files had the recorded SHA256. The exact first download was uploaded through `gtc`; a fresh CN download returned HTTP 200 and was byte-identical to GLOBAL.
+
+## Package shape and features
+
+The upstream archive contains `mcpp.toml`, C++23 module sources, and its `compat.mbedtls` dependency, so the existing Form A descriptor remains appropriate and requires no inline `mcpp` recipe. Version 0.2.9 adds no index-level optional source component, so no feature gate is needed.
+
+## Verification gates
+
+- Lua syntax and mirror-table lint for all package descriptors.
+- Resolver grammar parse with CI-pinned mcpp 0.0.87.
+- `tests/smoke_tinyhttps_module.sh` with CI-pinned mcpp 0.0.87 and `MCPP_INDEX_MIRROR=GLOBAL`. The script reseeds only the checkout's `pkgs/` into the builtin `mcpplibs` index because builtin namespaces cannot be overridden by a workspace path index. Limiting the copy to package descriptors also avoids copying workspace build trees produced by an earlier CI step.
+- CN HTTP 200 and byte-identical SHA256 verification.
+- GitHub Actions Linux, macOS, and Windows workspace jobs run the tinyhttps smoke after the workspace suite, plus CN reachability.
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 022a243..6762221 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -194,6 +194,11 @@ jobs:
           "$MCPP" --version
           # No `timeout` wrapper: absent on macOS runners; job-level timeout-minutes bounds it.
           "$MCPP" test --workspace
+      - name: tinyhttps module package smoke
+        shell: bash
+        env:
+          MCPP_INDEX_MIRROR: GLOBAL
+        run: bash tests/smoke_tinyhttps_module.sh
 
   # ── Exception: the public `imgui` C++23-module package (namespace "") ──
   # Not yet a workspace member: its package has an empty namespace (the builtin
diff --git a/pkgs/t/tinyhttps.lua b/pkgs/t/tinyhttps.lua
index 44832ce..2dd213e 100644
--- a/pkgs/t/tinyhttps.lua
+++ b/pkgs/t/tinyhttps.lua
@@ -68,6 +68,13 @@ package = {
                 },
                 sha256 = "a3d72396b267820405b675dd89c0889ef72605e3eedb94e000c6f48479b38001",
             },
+            ["0.2.9"] = {
+                url    = {
+                    GLOBAL = "https://github.com/mcpplibs/tinyhttps/archive/refs/tags/0.2.9.tar.gz",
+                    CN     = "https://gitcode.com/mcpp-res/tinyhttps/releases/download/0.2.9/tinyhttps-0.2.9.tar.gz",
+                },
+                sha256 = "b17e0b15d2c205a2918708bcd3ac992384f1a38d03232c28f17190a1db081e54",
+            },
         },
         macosx = {
             ["0.2.1"] = {
@@ -126,6 +133,13 @@ package = {
                 },
                 sha256 = "a3d72396b267820405b675dd89c0889ef72605e3eedb94e000c6f48479b38001",
             },
+            ["0.2.9"] = {
+                url    = {
+                    GLOBAL = "https://github.com/mcpplibs/tinyhttps/archive/refs/tags/0.2.9.tar.gz",
+                    CN     = "https://gitcode.com/mcpp-res/tinyhttps/releases/download/0.2.9/tinyhttps-0.2.9.tar.gz",
+                },
+                sha256 = "b17e0b15d2c205a2918708bcd3ac992384f1a38d03232c28f17190a1db081e54",
+            },
         },
         windows = {
             ["0.2.1"] = {
@@ -184,6 +198,13 @@ package = {
                 },
                 sha256 = "a3d72396b267820405b675dd89c0889ef72605e3eedb94e000c6f48479b38001",
             },
+            ["0.2.9"] = {
+                url    = {
+                    GLOBAL = "https://github.com/mcpplibs/tinyhttps/archive/refs/tags/0.2.9.tar.gz",
+                    CN     = "https://gitcode.com/mcpp-res/tinyhttps/releases/download/0.2.9/tinyhttps-0.2.9.tar.gz",
+                },
+                sha256 = "b17e0b15d2c205a2918708bcd3ac992384f1a38d03232c28f17190a1db081e54",
+            },
         },
     },
 }
diff --git a/tests/examples/tinyhttps/mcpp.toml b/tests/examples/tinyhttps/mcpp.toml
new file mode 100644
index 0000000..815fd8f
--- /dev/null
+++ b/tests/examples/tinyhttps/mcpp.toml
@@ -0,0 +1,6 @@
+[package]
+name = "tinyhttps-tests"
+version = "0.1.0"
+
+[dependencies]
+tinyhttps = "0.2.9"
diff --git a/tests/examples/tinyhttps/tests/api.cpp b/tests/examples/tinyhttps/tests/api.cpp
new file mode 100644
index 0000000..8fd1036
--- /dev/null
+++ b/tests/examples/tinyhttps/tests/api.cpp
@@ -0,0 +1,23 @@
+import std;
+import mcpplibs.tinyhttps;
+
+int main() {
+    using namespace mcpplibs::tinyhttps;
+
+    const auto request = HttpRequest::post("https://example.invalid/data", "{\"ok\":true}");
+    const auto proxy = parse_proxy_url("http://127.0.0.1:8088/path");
+    const auto chunk = parse_chunk_size_line("1a");
+    const auto invalid_chunk = parse_chunk_size_line("1x");
+
+    HttpResponse response{204, "No Content", {}, {}};
+    const bool ok = request.method == Method::POST
+                 && request.url == "https://example.invalid/data"
+                 && request.body == "{\"ok\":true}"
+                 && request.headers.at("Content-Type") == "application/json"
+                 && proxy.host == "127.0.0.1"
+                 && proxy.port == 8088
+                 && chunk == 26
+                 && !invalid_chunk.has_value()
+                 && response.ok();
+    return ok ? 0 : 1;
+}
diff --git a/tests/smoke_tinyhttps_module.sh b/tests/smoke_tinyhttps_module.sh
new file mode 100755
index 0000000..8a283c5
--- /dev/null
+++ b/tests/smoke_tinyhttps_module.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# The builtin mcpplibs namespace cannot be overridden by a workspace path index.
+# Reseed that index from this checkout, then exercise the checked-in example.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+MCPP_BIN="${MCPP:-$(command -v mcpp || true)}"
+if [[ -z "$MCPP_BIN" || ! -x "$MCPP_BIN" ]]; then
+    echo "FATAL: set MCPP=/path/to/mcpp or put mcpp on PATH" >&2
+    exit 1
+fi
+
+MCPP_HOME="${MCPP_HOME:-$HOME/.mcpp}"
+export MCPP_HOME
+default_index="$MCPP_HOME/registry/data/mcpplibs"
+rm -rf "$default_index"
+mkdir -p "$default_index"
+cp -a "$ROOT/pkgs" "$default_index/"
+rm -f "$default_index/.xlings-index-cache.json"
+printf 'ok\n' > "$default_index/.mcpp-index-updated"
+
+"$MCPP_BIN" self config --mirror "${MCPP_INDEX_MIRROR:-GLOBAL}" >/dev/null
+rm -rf "$ROOT/tests/examples/tinyhttps/target" "$ROOT/tests/examples/tinyhttps/.mcpp"
+cd "$ROOT/tests/examples/tinyhttps"
+"$MCPP_BIN" test