Take one signature, render the record, and open the upload door.

The order of operations is the whole of it, and it is deliberate:

1. verify the state, the affirmations, and that the text has not changed underneath the signer;
2. render the PDF and store it, so a row can never point at a document that does not exist;
3. INSERT the signature row -- append-only, enforced by trigger;
4. move the organization to active;
5. mail the copies, in the background.

A failure at step 2 leaves nothing signed. A failure at step 5 leaves an agreement that is signed and an email that did not arrive, which is the right way round: the signature is the fact, the email is a copy of it.