prevent calling send_buffered inside buffered_do

it does not make much sense, and it makes the "rollback" much too
complicated
documentation

also, make most of ::Buffered private