State-independent safety contracts #
TM.HoareSafety requires a tape predicate at every reachable configuration.
Unlike a fixed space predicate, it can charge only selected work tapes while
still bounding the output. Ordinary time contracts supply termination separately.