How to Build a Virtual Queue from Two Leaky Buckets (and why one is not enough)