A capacity race between the check and the write
Capacity was checked outside the transaction that wrote the row, so two concurrent accepts both passed the same check and both committed. Postgres read-then-write race.
It could not have worked
A race, an ordering, one column holding two things. The shape ruled it out before the code ran.
Capacity was checked outside the transaction that then wrote the status change, so two concurrent accepts could both pass a check against the same count and both commit. Fixed by counting inside the transaction, over accepted + enrollment_pending + confirmed, for both the admin status change and the customer's enrollment confirm — both paths can consume the same seat.
Worth noting the counted set: it's not "confirmed" alone. A seat that's been offered and not yet confirmed is spoken for, and counting only the final state would oversell.