| v = default-volid, ebm-cons(avols), v ∈ avols, avols ⊆ avols0, ebm-cons(avols) → ebm-cons(avols0) ⊦ ⟪ebm_vol_recover#(; avols0; v0, err)⟫ (err = ESUCCESS → v0 ∈ avols0 ∧ v0 = default-volid ∧ ebm-cons(avols0)) |
ebm-cons(avols), ebm-cons(avols0), default-volid ∈ avols, avols ⊆ avols0 ⊦ ⟪ebm_vol_recover#(; avols0; v0, err)⟫ (err = ESUCCESS → default-volid ∈ avols0 ∧ v0 = default-volid ∧ ebm-cons(avols0))