(* The master-snapshot PCM in the RCU paper divides the master into shares, which is useful for having both
   an authoritative writer and an up-to-date invariant. *)

Global Program Instance snap_PCM : Ghost :=
  { valid _ := True; Join_G a b c := sepalg.join (fst a) (fst b) (fst c) /\
      if eq_dec (fst a) Share.bot then if eq_dec (fst b) Share.bot then join (snd a) (snd b) (snd c)
        else ord (snd a) (snd b) /\ snd c = snd b else snd c = snd a /\
          if eq_dec (fst b) Share.bot then ord (snd b) (snd a) else snd c = snd b }.Definition ghost_snap (a : @G P) p := own p (Share.bot, a) NoneP.

(* Specifications: *)
Lemma ghost_snap_join : forall v1 v2 p v, join v1 v2 v -> ghost_snap v1 p * ghost_snap v2 p = ghost_snap v p.