Definition empty_on_path o p :=
    forall lvl, locate_node_in_tr o lvl p = None.Fixpoint diverge_at_level (p p' : path) (lvl : nat) :=
    match lvl with
    | 0%nat => False
    | S lvl' =>
      match p, p' with
      | [], [] => False
      | (true :: p_tail), (true :: p'_tail) =>
        diverge_at_level p_tail p'_tail lvl'
      | (false :: p_tail), (false :: p'_tail) =>
        diverge_at_level p_tail p'_tail lvl'
      | _, _ => True
      end
    end.(* off_path id v o p p' means that (id, v) lies on
      p' and not on p *)
  Definition off_path id v o p p' :=
    exists lvl,
      diverge_at_level p p' lvl /\
      match lookup_tree o lvl p' with
      | Some (Some bucket) => In (Block id v) bucket
      | _ => False
      end.

Lemma wr_op_wf : forall (id : block_id) (v : nat) (m : position_map) (h : stash) (o : oram) (p p_new : path), well_formed (State m h o) -> length p_new = LOP -> lookup_dict (makeBoolList false LOP) id m = p -> well_formed {| state_position_map := update_dict id p_new m; state_stash := {| block_blockid := id; block_payload := v |} :: remove_list (fun blk : block => block_blockid blk =? id) (concat (lookup_path_oram o p) ++ h); state_oram := clear_path o p |}.