Definition empty_on_path o p :=
    forall lvl, locate_node_in_tr o lvl p = None.Fixpoint diverge_at_level (p p' : path) (lvl : nat) :=
    match lvl with
    | 0%nat => False
    | S lvl' =>
      match p, p' with
      | [], [] => False
      | (true :: p_tail), (true :: p'_tail) =>
        diverge_at_level p_tail p'_tail lvl'
      | (false :: p_tail), (false :: p'_tail) =>
        diverge_at_level p_tail p'_tail lvl'
      | _, _ => True
      end
    end.(* off_path id v o p p' means that (id, v) lies on
      p' and not on p *)
  Definition off_path id v o p p' :=
    exists lvl,
      diverge_at_level p p' lvl /\
      match lookup_tree o lvl p' with
      | Some (Some bucket) => In (Block id v) bucket
      | _ => False
      end.

Lemma lookup_tree_lookup_path_oram_invert o : forall bkt p, In bkt (lookup_path_oram o p) -> exists lvl, lookup_tree o lvl p = Some (Some bkt).