Why do write attempts to /system/priv-app cause /system to switch to read-only?

I’m trying to write files to the /system/priv-app directory. I boot into recovery (TWRP) and run adb shell.

~ # mount /system ~ # mount rootfs on / type rootfs (rw,seclabel) ... /dev/block/mmcblkXXXX on /system type ext4 (rw,seclabel,relatime,data=ordered) 

I can then run:

~ # mkdir /system/tmp ~ # touch /system/tmp/test 

This works fine: I have no problem modifying /system. (I can also delete things from /system/priv-app.) But if I then try to write to /system/priv-app I get the following:

~ # mkdir /system/priv-app/test mkdir: can't create directory '/system/priv-app/test': Read-only file system ~ # mount rootfs on / type rootfs (rw,seclabel) ... /dev/block/mmcblkXXXX on /system type ext4 (ro,seclabel,relatime,data=ordered) 

Now /system is suddenly mounted read-only! Permissions and ownership are identical in /system and /system/priv-app and I’m running as root.

~ # ls -al / ... drwxr-xr-x   18 root     root          4096 Nov 25 07:32 system ~ # ls -al /system ... drwxr-xr-x   59 root     root          4096 Aug  5  1972 priv-app 

While in TWRP, SELinux is set to permissive:

~ # getenforce Permissive 

I’m running Lineage OS 14.1 (Android Nougat) on a Moto G 2015 (aka Moto G3). It’s rooted with the official Lineage su addon. I also tried Magisk and get the same result.

I’ve run out of ideas, and I can’t figure out the right search terms, because I’ve tried a ton of things and have not turned anything up.

How can I enable writing to /system/priv-app?