prep docs and service updates

tests/AirGap/StellaOps.AirGap.Time.Tests/TimeAnchorLoaderTests.cs

@@ -25,4 +25,28 @@ public class TimeAnchorLoaderTests
         Assert.True(result.IsValid);
         Assert.Equal("Roughtime", anchor.Format);
     }
+
+    [Fact]
+    public void RejectsIncompatibleTrustRoots()
+    {
+        var loader = new TimeAnchorLoader();
+        var hex = "010203";
+        var rsaKey = new byte[128];
+        var trust = new[] { new TimeTrustRoot("k1", rsaKey, "rsa") };
+
+        var result = loader.TryLoadHex(hex, TimeTokenFormat.Roughtime, trust, out _);
+
+        Assert.False(result.IsValid);
+        Assert.Equal("trust-roots-incompatible-format", result.Reason);
+    }
+
+    [Fact]
+    public void RejectsWhenTrustRootsMissing()
+    {
+        var loader = new TimeAnchorLoader();
+        var result = loader.TryLoadHex("010203", TimeTokenFormat.Roughtime, Array.Empty<TimeTrustRoot>(), out _);
+
+        Assert.False(result.IsValid);
+        Assert.Equal("trust-roots-required", result.Reason);
+    }
 }