Definition empty_on_path o p :=
forall lvl, locate_node_in_tr o lvl p = None.
Fixpoint diverge_at_level (p p' : path) (lvl : nat) :=
match lvl with
| 0%nat => False
| S lvl' =>
match p, p' with
| [], [] => False
| (true :: p_tail), (true :: p'_tail) =>
diverge_at_level p_tail p'_tail lvl'
| (false :: p_tail), (false :: p'_tail) =>
diverge_at_level p_tail p'_tail lvl'
| _, _ => True
end
end.
(* off_path id v o p p' means that (id, v) lies on p' and not on p *)
Definition off_path id v o p p' :=
exists lvl,
diverge_at_level p p' lvl /\
match lookup_tree o lvl p' with
| Some (Some bucket) => In (Block id v) bucket
| _ => False
end.

Lemma rd_op_wf : forall (id : block_id) (m : position_map) (h : stash) (o : oram) (p p_new : path),
lookup_dict (makeBoolList false LOP) id m = p ->
well_formed (State m h o) -> length p_new = LOP ->
well_formed
{|
state_position_map := update_dict id p_new m;
state_stash := (concat (lookup_path_oram o p) ++ h)%list;
state_oram := clear_path o p
|}.