# Bounded user I/O loop (K1226–K1230)

`write_all` and `read_exact` borrow their driver and buffer for the call. They
do not acquire, transfer, or release a descriptor or page owner. Each attempt,
including EINTR and a zero result, spends one unit of the caller's fixed call
budget. A short result advances only by the reported byte count. The caller
receives the exact completed byte count and attempt count on success or error.

Two zero writes without intervening byte progress return `Stalled` before another retry. A zero read
returns `EndOfInput`. A result longer than the remaining slice returns
`InvalidCount`. The budget returns `BudgetExceeded` without another driver
call. EINTR and kernel errors are distinct; a kernel error returns immediately.

Bytes already written to an external sink cannot be rolled back. The loop
reports partial progress and preserves borrowed buffer and descriptor
ownership. The local tests use a serial probe with exact output and owner
counts; guest integration is a separate K1230 gate.