oak-run, when connecting to a persistence storage, works like a live/independent oak instance. For clustered setup (read doc stores such backed by mongo or rdb), this means that another connected instance would treat oak-run's connection as a new one. While, theoretically, there is no issue with it and the world would work fine BUT an investigative tool such as oak-run->console should minimize touching the system as much as possible (especially while collecting forensics).
So, we should expose a parameter (say --read-only to oak-run->console while stating oak-run to connect to a document store storage. Note, read-only mode can be a global boolean for lifetime of oak-run (i.e. we don't really need dynamic switching between read-only and read-write modes)