What exactly means to sample from the set of congruence classes? Say one is doing some cryptography around the set of congruence classes, namely: $$\mathbb{Z}/n\mathbb{Z} = \mathbb{Z}_n = \{[0]_n, [1]_m, \dots, [n-1]_n\}.$$
Sometimes we use to write $a \leftarrow_R \mathbb{Z}_n$ to denote that we are sampling an element from $\mathbb{Z}_n$. But, what exactly means to perform such a sampling? I imagine that it is the following

Shorthand for $[a]_n \leftarrow_R \mathbb{Z}_n$ plus $a \leftarrow [a]_n$, i.e., taking the representative of the class, where $0 \leq a &lt;n$.

Is it like that? We typically use this sampled number as an exponent, so it would not make sense to sample an entire congruence class.
At the begginning I though that $a \leftarrow_R \mathbb{Z}_n$ was writing to avoid writing $[a]_n \leftarrow_R \mathbb{Z}_n$ too many times. But it would not make sense.
It is also often to see that $\mathbb{Z}_n = \{0, 1, \dots, n-1\}$. Is it a shorthand for its real meaning?
Sometimes we use to write $a \leftarrow_R \mathbb{Z}_n$ to denote that we are sampling an element from $\mathbb{Z}_n$. But, what exactly means to perform such a sampling?

When we talked about $\mathbb{Z}_n$ we usually consider the least residue system modulo $n$ that is the integers $\{0,1,\ldots,n-1\}$
When we write $a \stackrel r\gets \mathbb{Z}_n$ we usually mean possibly probabilistic process assignment, there are other variants.
When sampling uniformly one should be careful about the random source, simple taking modulus is dangerous and can be biased, discarding is required. Consider your random number generates random numbers in the range $[0,15]$ and you want to sample for $\mathbb Z_{13}$ than taking $\mod 13$ can create a bias since the 13 will map to 0, the 14 will map 1, and 15 will map to 2. Therefore their sampling is more than others, $2/16$ instead of $1/16$. Just discard the numbers $&gt;12$ and get a new random number.
One can use outside of the least residue system like

asked for RSA recently that $e &gt; \varphi(n)$ that will still represent an $e' = e  \bmod \varphi(n) $, or
one can get the private key $k$ in ECC longer than the order $n$ of the base point $G$. It is still useless since $[k]G = [k \bmod n]G$

But the devil in details;  sampling outside may carry some unintended side effects. Always check according to the context!
A further question;

Are we restricted to the least residue system?
Like the adversaries who can do whatever they want that suits their advantage, we can use it, too.

For example, to speed up the gcd we can allow negative remainders.
One may skip a modular reduction step that will cause the number not in the range $[0,n-1]$ and probably higher, Omura '90. In the end, the result must be in the least residue.

In some context, we require the residue as $(n/2,n/2]$ because it forms a ball around the origin and can help to better understand.



For instance, when we want to use ElGamal we write $g^x$, but what we are actually writing? $g^x$ or $g^{[x]_q}$.

First one, since we sample from $[2,q-1]$. When $g^{[x]_q}$ is written it means that the $[x]_q$ can be any of $x+kq$ wher $k \in \mathbb Z - \{0\}$.