Record an acceptance, render the filled PDF, and email it. Order is deliberate: render the PDF, INSERT the acceptance row (born at the transient ``email_status="pending"``), then send, then one narrow update that stamps ``email_status`` / ``email_error`` and nothing else. The acceptance is durable before anything leaves the building, so a Mongo failure after a successful send can never leave a customer holding a PDF and a download link for a record that does not exist. A failed insert returns 503 and sends nothing. A mail failure cannot lose the acceptance either: ``send_agreement_emails`` never raises, it returns a status. Contract enum on the returned and persisted ``email_status``: ``sent`` | ``skipped_no_provider`` | ``failed``. ``pending`` is an internal pre-send value that is never returned to a client and never survives a successful request; a row left at ``pending`` means the delivery outcome could not be stamped and is reconcilable from the log.