core: Change `BorrowedCursor::written`'s origin

This enable removing the `start` field, so `BorrowedCursor` fits in a
single register. Because `written` is almost always used in difference
with another call, this changes nothing else in practice.