TIL that #systemd can alter what mounts a process can see, so that running "mount | grep <dir>" as a particular process might show it mounted as read-only when it's mounted read-write globally.