guaranteed undo boundaries

[Roland Winkler]

Is it possible to set up a command or function foo such that one may
rely upon the fact that all changes performed by foo in a buffer
when foo is called once, will be undone calling undo exactly once in
this buffer?

I know the function undo-boundary. I also know the macro
atomic-change-group. Yet in both cases I am not sure from the
docstring / the elisp manual whether one may rely on the fact that
each call of foo gives exactly one undo boundary.

The context of my question is BBDB. Here it is crucial that each
change to the buffer visiting the database must be carried out such
that the database remains in a well-defined state. Half a change
gives a corrupted database. Therefore, each function performing any
such changes in this buffer is doing its job such that when the
function has completed its job BBDB is again in a well-defined
state. (For modifying the buffer visiting the database, these
functions only use insert, insert-before-markers, delete-region and
delete-char.)

Yet currently BBDB does not provide any possibility to undo changes
in its database (meaning first of all: undoing changes in the buffer
visiting the database, which then need to propagate back into BBDB).
I thought that I could add at least some rudimentary undo feature if
each function that changes the database gives exactly one boundary
in buffer-undo-list. So if one undoes changes of the buffer one by
one, the database always remains in a well-defined state.

Possibly this is already guaranteed, merely this could be spelled out
more explicitly in some docstring / the elisp manual. Possibly, I am
missing something else.

Roland

PS: A proper command bbdb-undo will require yet more than the above.
Please do not expect that such a feature will find its way into BBDB
in the near future.