Open_basedir strange behavior after modifying docroot

I’m changing domain.xyz’s docroot to point at main-site.com. I’m using php-fpm/default.tpl for both web domains, which says:

php_admin_value[open_basedir] = /home/%user%/.composer:/home/%user%/web/%domain%/public_html:/home/%user%/web/%domain%/private:/home/%user%/web/%domain%/public_shtml:/home/%user%/tmp:/tmp:/bin:/usr/bin:/usr/local/bin:/usr/share:/opt

When I try to open /home/user/web/main-site.com/private/somefile from https://domain.xyz/myscript.php, I get an open_basedir restriction error.
Trying to debug it, print_r(explode(PATH_SEPARATOR,ini_get('open_basedir'))) gives me:

Array (
[0] => /home/user/.composer
[1] => /home/user/web/main-site.com/public_html/
[2] => /home/user/web/domain.xyz/private
[3] => /home/user/web/domain.xyz/public_shtml
[4] => /home/user/tmp
[5] => /tmp
[6] => /bin
[7] => /usr/bin
[8] => /usr/local/bin
[9] => /usr/share
[10] => /opt
)

How come [2] and [3] are inconsistent with how the above .tpl is supposed to work? What can I do to investigate this?

…Anyone?