A guest can complete a booking for dates inside your advance-notice window, even though the calendar shows those dates as greyed out.
Why this happens. Two separate settings control this behavior, and they operate independently. The HomeRunner Toolkit Advance Notice Blocking module controls which dates the calendar greys out and the hover message guests see. Checkout validation is controlled by a different setting: HomeRunner > Settings > Property settings > Validate advance booking hours. If that value is set to fewer hours than the calendar window, checkout accepts reservations that the calendar would not let a guest select. For example, if the calendar module is set to 168 hours (7 days) but the plugin validate setting is 48 hours, the effective checkout boundary is 48 hours.
What you can do. Set both values to the same number of hours so the calendar and checkout agree.