1. A method for classification, comprising: storing in a ternary content-addressable memory (TCAM) a plurality of classification rules comprising respective tags, each tag comprising a string of maskable bits, including an update bit; receiving and classifying data items according to the classification rules by extracting a respective key from each data item, appending an update-select bit to the extracted key, thereby constructing an extended key, and matching the extended key to one of the tags in the TCAM; in a default classification state, masking the update bit in all of the classification rules and setting the update-select bit in the extended key of all the received data items to a first bit value; and in response to an instruction to atomically replace a group of existing rules in the TCAM with new rules: in the group of the existing rules, unmasking the update bit, which is set to the first bit value; storing the new rules in the TCAM, with the update bit in the new rules set to a second bit value, different from the first bit value, and unmasked; and after storing the new rules in the TCAM, setting the update-select bit in the extended key of the received data items to the second bit value.