A booking can no longer be made without the diver's details

The checks on date of birth, certification and the signed waiver ran only in the customer's browser, and the refusal arrived after the booking already existed. Now the details travel with the booking and the server refuses both together, so a refusal means no booking at all.

Nothing is created when details are missing — before this, a refused diver left a booking with a seat sold and nobody on it, and the customer carried on to payment.
The waiver is checked on the booking page too — it was already required on the form we email a guest, but not on the page itself.
Your office is unchanged — staff still take a booking with whatever details they have and chase the rest, on paper or by form.