Definition has_ext {Z} (ora : Z) : pred rmap := @own (ext_PCM _) 0 (Some (Tsh, Some ora), None) NoneP.
Definition jm_bupd {Z} (ora : Z) P m := forall C : ghost,
(* use the external state to restrict the ghost moves *)
join_sub (Some (ext_ref ora, NoneP) :: nil) C ->
joins (ghost_of (m_phi m)) (ghost_approx m C) ->
exists m' : juicy_mem, joins (ghost_of (m_phi m')) ((ghost_approx m) C) /\
jm_update m m' /\ P m'.

Lemma jm_bupd_intro: forall {Z} (ora : Z) (P : juicy_mem -> Prop) m, P m -> jm_bupd ora P m.
Section juicy_safety.