only allow raw cursor reads from places where it makes sense. This
forces users to consider concurrency implications, important given that
rendering itself may be asynchronous.