Program Definition bupd (P: pred rmap): pred rmap :=
fun m => forall c, joins (ghost_of m) (ghost_approx m c) ->
exists b, joins b (ghost_approx m c) /\
exists m', level m' = level m /\ resource_at m' = resource_at m /\ ghost_of m' = b /\ P m'.
Next Obligation.

(* Specifications: *)
Lemma bupd_intro: forall P, P |-- bupd P.
Lemma bupd_mono: forall P Q, P |-- Q -> bupd P |-- bupd Q.
Lemma bupd_frame_r: forall P Q, bupd P * Q |-- bupd (P * Q).
Lemma bupd_frame_l: forall P Q, P * bupd Q |-- bupd (P * Q).
Lemma bupd_trans: forall P, bupd (bupd P) |-- bupd P.
Lemma bupd_prop : forall P, bupd (!! P) = !! P.
Lemma subp_bupd: forall (G : pred nat) (P P' : pred rmap), G |-- P >=> P' ->
G |-- (bupd P >=> bupd P')%pred.
Lemma eqp_bupd: forall (G : pred nat) (P P' : pred rmap), G |-- P <=> P' ->
G |-- (bupd P <=> bupd P').