Generating Safe Assumption-Based Plans for Partially Observable, Nondeterministic Domains