| avols ⊆ avols0, ebm-cons(avols) → ebm-cons(avols0), ebm-cons(avols) ⊦ ⟪ebm_recover#(; avols0; err)⟫ (err = ESUCCESS → ebm-cons(avols0)) |
ebm-cons(avols), avols ⊆ avols0, ebm-cons(avols) → ebm-cons(avols0) ⊦ ⟪ebm_recover#(; avols0; err)⟫ (err = ESUCCESS → ebm-cons(avols0))