transfer

Move amount of quota from from to to by appending to from's own row of the transfers matrix. Returns a Patch when from has quota to release; null otherwise. The caller's state is unchanged either way. amount must be positive and from must differ from to.

Two concurrent donors transferring to the same receiver compose correctly: each writes its own row, and the per-row merge keeps both.

This is the sender-side primitive of the transfer. Rung 5b will add the request/grant protocol over a Seam; without it, peers degrade gracefully to "deny when low".