Clarifying path normalization, or lack thereof

Any WASI runtime acting as any sort of sandbox should restrict access to unmapped paths. However, through path normalization, a path might end up "within" the sandbox. The question is, should WASI implementations be expected to implement such normalization, or is it safe to assume callers should normalize their own paths if they want that behavior?

That is, given:

let root : Fd = 4; // ...preopened directory fd...

Which of these, if any, should reasonably be expected to succeed? And in the case of symlinks, should ".." navigate to the parent based on the path before the symlinks resolve, or after?

let root2 : Fd = path_open(root,  ..., ".",  ...).unwrap();

let root2 : Fd = path_open(root,  ..., "existing/..",  ...).unwrap();

let root2 : Fd = path_open(root,  ..., "symlink/..",  ...).unwrap();

let root2 : Fd = path_open(root,  ..., "nonexistant/..",  ...).unwrap();

let dir   : Fd = path_open(root, ..., "existing", ...).unwrap();
let root2 : Fd = path_open(dir,  ..., "..",  ...).unwrap();

let dir   : Fd = path_open(root, ..., "symlink", ...).unwrap();
let root2 : Fd = path_open(dir,  ..., "..",  ...).unwrap();

Start by reading the WASI path_open semantics and the sandboxing expectations described in the issue. Compare the listed cases involving '.', '..', symlinks, and nonexistent paths, then establish and document consistent normalization and resolution rules for each case.