diff --git a/todo.md b/todo.md
index 0750a20..b694637 100644
--- a/todo.md
+++ b/todo.md
@@ -6,7 +6,7 @@
 
 `Bar = 1`
 
-`Next ID = 58`
+`Next ID = 59`
 
 ## Items
 
@@ -16,6 +16,7 @@
 | 2 | 0.5.0 |  |  | **Rename the admin example plugin to a name that says what it administers.** | 3 | 1 | 2 | 4 | 6 | 9 by 3, code health by 2 | 2.6 |
 | 5 | 0.5.0 |  |  | **List grants that no installed plugin declares, with a remove action.** | 2 | 2 | 2 | 4 | 4 | 2 by 3 | 2.1 |
 | 41 | 0.5.0 |  |  | **Apply a permission save as one Keto call, so it cannot stop part-way.** | 2 | 2 | 2 | 4 | 3 | 2 by 2 | 2.1 |
+| 58 | 0.5.0 |  |  | **Let an operator hide a plugin's profile-menu entry from `config/menu.ts`.** | 2 | 2 | 2 | 4 | 4 | 7 by 3 | 2.0 |
 | 19 | 0.6.0 |  | question | **Run the documented Docker commands on macOS and fix whatever misbehaves.** | 2 | 2 | 1 | 3 | 3 | 1 by 3 | 3.3 |
 | 16 | 0.6.0 |  | question | **Decide whether the single Keto `Resource` namespace splits into per-domain namespaces.** | 3 | 2 | 3 | 6 | 6 | 7 by 2 | 0.5 |
 | 14 | 0.6.0 |  |  | **Drop a double-clicked duplicate submit, with no client-side JavaScript.** | 4 | 2 | 3 | 7 | 7 | 2 by 7, 1 by 4 | 1.4 |
@@ -53,6 +54,15 @@ and deletes in one transaction; confirm that against the Keto version `ory/` pin
 call to `KetoClient`, which is contract surface (`@plainpages/plugin-api`) and so needs 0.5.0, and the
 partial-failure path in the admin example can go.
 
+### 58. Let an operator hide a plugin's profile-menu entry from `config/menu.ts`.
+
+A manifest's `profileMenu` entries have no `id`, and the central override (`NavOverride` in
+`src/ui/nav.ts`) targets sidebar nav nodes only, so hiding or renaming one means forking the plugin,
+though README → The menu system promises hide and rename for menu items. The fix gives an entry an optional
+`id`, unique across plugins through a `findConflicts` kind like `nav-id`, and applies `hide` and
+`rename` to it in `profileLinks` (`src/ui/chrome.ts`). The alternative is a decision recording
+profile entries as plugin-only, with README saying so.
+
 ### 19. Run the documented Docker commands on macOS and fix whatever misbehaves.
 
 Needs a Mac. Two suspects, both from `--user "$(id -u):$(id -g)"`: a macOS `id -g` is `20`, which is