A yoga class with twelve mats and a spa room with one table have the same problem: two people can try to take the last place in the same second.
Vestibel locks the session row before reading its booked count, inside the transaction that writes the booking. Two cashiers racing for the last seat produce exactly one booking and one refusal that says how many places are actually left. Reading the count first and writing after — the obvious implementation — silently admits both.
Recurring availability is generated from a schedule rule into concrete sessions ahead of time, idempotently, so a nightly job that runs twice does not double the diary.
Cancellation is concurrency-safe in the same way, and applies the property's cancel-window fee if the policy is breached rather than leaving it to the receptionist to remember.