diff --git a/build_windows.ps1 b/build_windows.ps1
index 3eb2716..edadc1e 100644
--- a/build_windows.ps1
+++ b/build_windows.ps1
@@ -19,25 +19,18 @@ pyinstaller engine.spec --clean --noconfirm
 Write-Host "== [3.5/6] Verify bundle contents (app/static, app/templates phai co) =="
 # Bat loi bundle NGAY tai build (da gap 2 lan: chay pyinstaller tu noi khac
 # -> static/templates thieu -> exe crash 'Directory ...\app\static does not exist').
-$missing = @()
-if (-not (Test-Path "build\engine\Analysis-00.toc")) {
-  # PyInstaller 6.x: doc TOC truc tiep tu Analysis
-  $tocFiles = Get-ChildItem "build\engine" -Filter "*.toc" -ErrorAction SilentlyContinue
-  if ($tocFiles) {
-    $tocContent = Get-Content $tocFiles[0].FullName -Raw
-    if ($tocContent -notmatch "app/static") { $missing += "app/static" }
-    if ($tocContent -notmatch "app/templates") { $missing += "app/templates" }
-  }
-} else {
-  $tocContent = Get-Content "build\engine\Analysis-00.toc" -Raw
-  if ($tocContent -notmatch "app/static") { $missing += "app/static" }
-  if ($tocContent -notmatch "app/templates") { $missing += "app/templates" }
-}
-if ($missing.Count -gt 0) {
-  Write-Host "ERROR: Bundle thieu: $($missing -join ', '). Dung build - kiem tra engine.spec datas!" -ForegroundColor Red
+# Dung tools/verify_bundle.py (parse TOC bang ast, chap nhan ca / va \) thay
+# vi regex thong thuong (TOC Windows co the dung backslash -> false positive).
+# Truoc tien kiem tra engine.spec phai la ban moi (collect_data_files).
+$specContent = Get-Content "engine.spec" -Raw -ErrorAction SilentlyContinue
+if ($specContent -notmatch "collect_data_files\('app'") {
+  Write-Host "ERROR: engine.spec CU (thieu collect_data_files('app')). Pull code moi truoc khi build!" -ForegroundColor Red
+  exit 1
+}
+python tools\verify_bundle.py
+if ($LASTEXITCODE -ne 0) {
+  Write-Host "ERROR: Bundle thieu asset - dung build, kiem tra engine.spec datas!" -ForegroundColor Red
   exit 1
-} else {
-  Write-Host "OK: app/static + app/templates co trong bundle." -ForegroundColor Green
 }
 
 Write-Host "== [4/6] Sidecar binary -> src-tauri/binaries (tauri triple naming) =="
diff --git a/tools/verify_bundle.py b/tools/verify_bundle.py
new file mode 100644
index 0000000..139085e
--- /dev/null
+++ b/tools/verify_bundle.py
@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+"""Verify PyInstaller bundle TOC chua du app assets (app/static, app/templates).
+
+Dung boi build_windows.ps1 (buoc 3.5/6) de bat loi bundle NGAY tai build:
+  python tools/verify_bundle.py
+Exit code 0 = OK, 1 = thieu asset.
+
+Ly do ton tai: da gap 2 lan exe crash 'Directory ...\\app\\static does not exist'
+vi chay pyinstaller tu noi khac -> datas relative khong resolve -> bo qua am tham.
+"""
+import glob
+import os
+import re
+import sys
+
+REQUIRED = ["app/static", "app/templates"]
+
+
+def find_toc(build_dir: str) -> str:
+    # PyInstaller 6.x: build/engine/Analysis-00.toc (hoac *-00.toc khac)
+    for pattern in (
+        os.path.join(build_dir, "engine", "Analysis-00.toc"),
+        os.path.join(build_dir, "engine", "*-00.toc"),
+        os.path.join(build_dir, "**", "Analysis-00.toc"),
+        os.path.join(build_dir, "**", "*-00.toc"),
+    ):
+        hits = glob.glob(pattern, recursive=True)
+        if hits:
+            return hits[0]
+    return ""
+
+
+def main() -> int:
+    build_dir = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "build"))
+    toc = find_toc(build_dir)
+    if not toc:
+        print(f"WARN: khong tim thay TOC trong {build_dir} - bo qua verify (tiep tuc build)")
+        return 0
+    print(f"Verify TOC: {toc}")
+    with open(toc, "r", encoding="utf-8", errors="replace") as f:
+        raw = f.read()
+    # TOC Windows co the dung backslash (app\\static) — normalize het ve forward
+    # slash de kiem tra khong bi false positive.
+    text = raw.replace("\\", "/")
+    missing = []
+    for req in REQUIRED:
+        # Tim theo prefix thuc su trong TOC (vd 'app/static/js/...' hoac
+        # string repr 'app/static/...' trong tuple DATA entry).
+        if not re.search(re.escape(req) + r"(?=[/'\"]|$)", text):
+            missing.append(req)
+    if missing:
+        print(f"ERROR: Bundle thieu: {', '.join(missing)}. Kiem tra engine.spec datas!")
+        return 1
+    print("OK: app/static + app/templates co trong bundle.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/wiki.md b/wiki.md
index b3ebc11..6d57283 100644
--- a/wiki.md
+++ b/wiki.md
@@ -1,3 +1,11 @@
+### [2026-08-08] FIX: verify bundle [3.5/6] false-positive 'app/static thieu' + check spec version — tools/verify_bundle.py
+- **Tóm tắt thay đổi:** User chạy build_windows.ps1 — bước verify [3.5/6] mới báo "ERROR: Bundle thieu: app/static, app/templates" nhưng thực tế bundle ĐỦ (collect_data_files('app') đã hoạt động — verify bằng build Linux). Root cause: script verify cũ dùng regex `-notmatch "app/static"` trên raw TOC — trên Windows TOC chứa `app\static` (BACKSLASH) → regex forward-slash không match → FALSE POSITIVE báo thiếu. Fix:
+  1. **tools/verify_bundle.py** (mới): verify TOC bằng Python — đọc text, `replace('\\','/')` normalize backslash→forward, regex theo prefix `app/static(?=[/'"]|$)`; exit 0 OK / 1 thiếu; không có TOC → WARN + exit 0 (không chặn build). Test 4 case: backslash OK, forward OK, thiếu static → ERROR, không TOC → WARN.
+  2. **build_windows.ps1 [3.5/6]**: trước tiên check `engine.spec` có chứa `collect_data_files('app')` — nếu spec CŨ (chưa pull code mới) → báo rõ "engine.spec CU... Pull code moi" + exit 1 (tránh nhầm lẫn nguyên nhân). Sau đó chạy `python tools\verify_bundle.py` + check `$LASTEXITCODE`.
+- **Các file ảnh hưởng:** `tools/verify_bundle.py` (mới), `build_windows.ps1` (bước 3.5 gọi script + check spec)
+- **Ghi chú/Test (nếu có):** verify_bundle.py test 4 case đều đúng; chạy với TOC THẬT (build Linux PyInstaller 6.21) → "Thiếu: KHÔNG — OK". Binary frozen: /health OK, index 200, static js 200. pytest 86 passed. User: pull code mới (có tools/verify_bundle.py) rồi chạy lại build_windows.ps1.
+
+---
 ### [2026-08-08] FIX: build_windows.ps1 lỗi parse PowerShell — "String is missing terminator" (file chứa ký tự Unicode, PS 5.1 đọc theo ANSI)
 - **Tóm tắt thay đổi:** User chạy build_windows.ps1 trên Windows nhận ParserError "String is missing terminator" ở dòng 57 + "Missing closing '}'" ở dòng 34. Root cause: bản mình thêm bước verify [3.5/6] có chứa ký tự Unicode (em-dash `—` trong comment + chuỗi tiếng Việt có dấu "thiếu/Dừng/kiểm tra"). PowerShell 5.1 đọc file .ps1 KHÔNG có BOM theo ANSI/Windows-1252 → byte UTF-8 của `—` (E2 80 94) giải mã thành `â€"` — dấu ngoặc kép giả chui vào giữa chuỗi → chuỗi "mất terminator" + block `{}` lệch. Fix:
   1. Viết lại toàn bộ build_windows.ps1 **chỉ ASCII** (bỏ dấu tiếng Việt, bỏ em-dash, dùng `->`).