docs(design): ratify C18 unknown-family-id contract (treat-as-empty, exit 0)

The Runway milestone fieldtest surfaced a spec_gap: `aura runs family <id>`
with an unknown-but-well-formed id exits 0 with empty output, and neither the
ledger nor the glossary constrained that case. The behaviour is already the
documented, tested CLI contract (treat-as-empty, mirroring Registry::load's
missing-store = Ok(empty)); this lifts that contract to the durable C18 note
so a consumer reasoning from the spec can derive it, and records that tightening
to a non-zero "no such family" exit (typo-safety) stays an available future UX
choice rather than a current contract.

Ratifies the spec_gap from docs/specs/0055-fieldtest-runway-real-data-seam.md.

docs/design/INDEX.md

@@ -748,7 +748,14 @@ lib API is retained: `rank_by`/`optimize` keep live consumers (`optimize` backs
 walk-forward's in-sample step, `rank_by` backs `runs family … rank`); `append`/
 `load` (the flat-store half) remain public API with **no in-tree caller** after
 this retire — tested, available to external consumers, a latent dead-code surface
-a later sweep may revisit.
+a later sweep may revisit. **Unknown-id contract (ratified, Runway fieldtest
+2026-06).** `aura runs family <id>` treats an unknown-but-well-formed id as an
+*empty family* (prints nothing, exit 0) — the same treat-as-empty discipline as
+`Registry::load` reading a missing store as `Ok(empty)`, and deliberately
+distinct from the retired `list`/`rank` exit-2, which is argv-shape rejection
+*before* any store access, not a found-nothing lookup. Tightening to a non-zero
+`no such family <id>` exit (typo-safety) is an available future UX choice, not a
+current contract.
 
 ### C19 — Bootstrap: blueprint → instance (recursive)
 **Guarantee.** Construction is a distinct phase, recursive at every level. Each