Inspect both sides
Record WSL version, distribution, NAT/mirrored mode, proxy location and host/guest users. Host loopback access and address-family support depend on mode and version. Do not expose a listener on every interface for convenience.
DNS tunneling and automatic proxy import may delegate behavior to the host. A guest resolver file or guest packet deny alone does not prove the host path.
Host delegates and change scope
A guest may invoke a Windows process under a different enforcement identity. Clearing PATH does not prevent absolute-path execution. Review mounts, sockets and privileged helpers.
Follow both Windows and Linux acceptance plans. Global settings and restart commands can affect other distributions; do not stop all WSL or restart the host just to complete a check.