 Snapshot-before-update semantics

For an update $a\leftarrow F(a,b)$, compute from $a_0,b_0$, the values before any mutation. Stable snapshots ensure self-addition doubles the old value and self-subtraction produces zero. Building a replacement representation privately and committing it once can additionally preserve the receiver if validation or checked arithmetic fails. This makes the meaning of an update independent of iteration order and aliasing between its operands.