I think readwritesplit should lock into a master-only mode when autocommit is disabled. It should probably also route the auto-commit to the master.

This is a more complex issue: the SET autocommit=0 needs to be executed on the master server and re-executed every time a reconnection or a master switch takes place. This means that a separate history for the master might have to be kept in order to prevent these sorts of problems.

The given example can only happen if a routing hint is used to override the routing logic in readwritesplit. Normally without it this won't cause problems as the transactions started on the other servers are empty and do not cause conflicts. It's still not ideal that this can happen but I would say it's rare to intentionally break the transaction logic just to offload traffic.

I'll go ahead and close this as Won't Fix and document it as a known limitation in addition to the already documented fact that you can end up breaking things if you use routing hints in the wrong way.