Hi Carl, thanks for answering!

Anyway it's already like that but a bit more complex:

class Data
{
   public void A()
   {
       B(); // if B() fail, C() will never happen
       C();
       OnA();
   }
   public virtual OnA() { /* potential adverse user code */ }

   public void B()
   {
       // stuff ...
       OnB();
   }
   public virtual OnB() { /* potential adverse user code */ }

   public void C()
   {
       // stuff...
       OnC();
   }
   public virtual OnC() { /* potential adverse user code */ }
}
// OnA(), OnB(), OnC() can't be removed, they are used by other part of the
API to track elementary change

However I was able to get around it.
All user notifications happen now in such a way that user exception let the
data in an unexpected, yet correct, state.
Although observers might get corrupted in the process, but it's not as
important/bad.

I no longer try to undo partial change (which could led to other exceptions
and I had no idea how to handle that correctly).

interesting, thanks!