docs(phase-20): add gap-closure plans 20-07 to 20-09 to the roadmap

.planning/ROADMAP.md

@@ -1270,7 +1270,7 @@ Plans:
   3. An S3 blob driver can be selected through framework config, so the application does not import it. `/api-docs` and `/api-docs.json` can be served. Turnstile verification middleware is available.
   4. The touched modules' READMEs and `docs/` pages are updated. The new code has unit tests, delivered in the phase's last plan.
 
-**Plans:** 6/6 plans executed
+**Plans:** 6/9 plans executed
 
 Plans:
 **Wave 1**
@@ -1554,6 +1554,13 @@ Plans:
 **Wave 6** *(blocked on Wave 5 completion)*
 - [x] 20-06-PLAN.md — unit tests (Go, layers, site), two-browser chat and DM call checks, phase gate and live verification
 
+**Wave 7** *(gap closure, code review)*
+- [ ] 20-07-PLAN.md — filter hardening (CR-02, CR-03): normalised text and canonical link hosts in sm-moderation-plugin, rendered-HTML check in sm-forum-plugin, bypass regression tests
+- [ ] 20-08-PLAN.md — call and session fixes (CR-01, WR-01, WR-04, WR-05): useCall cancellation, join confirmation, failed-connect end, chat link guard, logout reset
+
+**Wave 8** *(blocked on Wave 7 completion)*
+- [ ] 20-09-PLAN.md — release, redeploy and recheck: suites, patch tags, demo bumps, rome deploy, live bypass and call probes, changelog posts, disposition ledger
+
 ### Phase 30: Płytarium cutover
 
 **Goal**: The parity harness is green on every manifest route and `vue-fonoteka-app` and `fonoteka-mcp` run unchanged against the Go backend in daily use in production — the Płytarium definition of done.