on_update_exn t ~f calls f after the current stabilization and after each
subsequent stabilization in which t changes, until disallow_future_use t is
called. f will be called at most once per stabilization. Here is a state
diagram for the allowable sequences of Update.t's that can be supplied to a
particular f:
           /-----------------------------------------------------\
           |                 /                                   |
           |                 |                                   v
          Start ------> Initialized ------> Changed ------> Invalidated
                                              ^  |
                                              \--/on_update_exn raises if disallow_future_use t was previously called.
include sig ... endval sexp_of_t : ('a ‑> Sexplib.Sexp.t) ‑> 'a t ‑> Sexplib.Sexp.t