Enforce single AttestationData per block (leanSpec PR #510)

Makefile

@@ -24,7 +24,7 @@ docker-build: ## 🐳 Build the Docker image
 		-t ghcr.io/lambdaclass/ethlambda:$(DOCKER_TAG) .
 	@echo
 
-LEAN_SPEC_COMMIT_HASH:=ad9a3226f55e1ba143e0991010ff1f6c2de62941
+LEAN_SPEC_COMMIT_HASH:=d39d10195414921e979e2fdd43723d89cee13c8b
 
 leanSpec:
 	git clone https://github.com/leanEthereum/leanSpec.git --single-branch

crates/blockchain/src/key_manager.rs

@@ -5,6 +5,7 @@ use ethlambda_types::{
     primitives::{H256, HashTreeRoot as _},
     signature::{ValidatorSecretKey, ValidatorSignature},
 };
+use tracing::info;
 
 use crate::metrics;
 
@@ -102,6 +103,23 @@ impl KeyManager {
             .get_mut(&validator_id)
             .ok_or(KeyManagerError::ValidatorKeyNotFound(validator_id))?;
 
+        // Advance XMSS key preparation window if the slot is outside the current window.
+        // Each bottom tree covers 65,536 slots; the window holds 2 at a time.
+        // Multiple advances may be needed if the node was offline for an extended period.
+        if !secret_key.is_prepared_for(slot) {
+            info!(validator_id, slot, "Advancing XMSS key preparation window");
+            while !secret_key.is_prepared_for(slot) {
+                let before = secret_key.get_prepared_interval();
+                secret_key.advance_preparation();
+                if secret_key.get_prepared_interval() == before {
+                    return Err(KeyManagerError::SigningError(format!(
+                        "XMSS key exhausted for validator {validator_id}: \
+                         slot {slot} is beyond the key's activation interval"
+                    )));
+                }
+            }
+        }
+
         let signature: ValidatorSignature = {
             let _timing = metrics::time_pq_sig_attestation_signing();
             secret_key