double buffered queue, for safety