Ideal behavior:
  -- all commands acquire either a read lock or a write lock
  -- they either succeed entirely (wrt locking, anyway), or fail immediately at the beginning of their run

To do this right, we should have a static difference between "readable db" and "readwriteable db", I think.  (This makes certain kinds of caching harder, of course, logically non-writing operations might in fact want to update caches or something... fortunately we have no such on-disk caches ATM.)

Then each command could receive one sort of db or the other, and pass it on to each function it calls.  Then all the above properties could be achieved statically.

This full solution is a bit intrusive, though IMO fully worth it.  In the mean time, it would be good to, e.g., have read and write transactions, and ensure at run time that write operations only occurred inside write transactions.  This solution is bad in the long run, though, because with it we will have another class of bugs that always come back sooner or later.