AtomCaml: first-class atomicity via rollback