diff --git a/docs/UNIFIED-TASK-TRACKER.md b/docs/UNIFIED-TASK-TRACKER.md
index 66c94106..73a324f5 100644
--- a/docs/UNIFIED-TASK-TRACKER.md
+++ b/docs/UNIFIED-TASK-TRACKER.md
@@ -44,17 +44,25 @@ those are marked ✅ below with the commit that did it, so we stop re-litigating
 
 ## Tier 1 — Medium effort, unblocked
 
-- [ ] **immich → Quadlet migration** — last legacy in-cgroup app; manifest still
-      declares plain `immich-postgres`/`immich-redis` containers instead of Quadlet
-      units (`apps/immich/manifest.yml`). Blocks deleting the legacy `create_container`
-      path (see Phase 3.5 in master plan).
-- [ ] **Netbird reinstall adoption path** — verify whether the adopted-container path
-      actually skips cert/file rendering on reinstall (unconfirmed either way;
-      `wait_for_adopted_container` in `install.rs:326` exists but no dedicated
-      cert-render check was found). Reproduce on .228 (has netbird installed) before fixing.
-- [ ] **TanStack Query (or equivalent) investigation** — still just a backlog idea, no
-      code. Time-box a spike: is neode-ui's current fetch/store pattern actually
-      causing real bugs, or is this nice-to-have? Decide before spending real time.
+- [x] ~~immich → Quadlet migration~~ — investigated 2026-07-01, turned out already done:
+      immich uses the same `install_stack_via_orchestrator` primitive as netbird/btcpay
+      (`immich_stack_app_ids()` in `stacks.rs:690`), and is confirmed running as real
+      Quadlet units live on .228 (`immich_server.container`, `immich_postgres.container`,
+      `immich_redis.container`, all active). Not a legacy in-cgroup app — the only
+      remaining piece is the fleet-wide Phase-3 default-flip, already tracked in Tier 2.
+- [x] ~~Netbird reinstall adoption path~~ — investigated 2026-07-01, **not a bug, by
+      design.** `adopt_stack_if_exists()` (`stacks.rs:140-198`) is only used as a
+      fallback when the orchestrator has no manifest for the app — there's nothing to
+      render certs/config from in that case, so skipping rendering is correct. When
+      the orchestrator *does* have the manifest (the normal path), the reconcile loop
+      already re-renders certs even for adopted-running containers, fixed in
+      `4519dbf0` (`prod_orchestrator.rs:1707-1708`).
+- [x] ~~TanStack Query (or equivalent) investigation~~ — spike complete 2026-07-01,
+      **recommendation: don't adopt / close as not needed.** Only 3 stores actually fetch
+      data, WebSocket push already handles hot data (server-info/package-data), no
+      cache-invalidation or stale-data bugs found, migration would touch 62 RPC call
+      sites for no concrete payoff. If boilerplate ever bothers us, extract a
+      `usePolling()` composable instead — much cheaper than a query-cache migration.
 
 ## Tier 2 — High effort, unblocked (the actual next exit criteria)