Proving the singlethreading