Does Windows 11 Hyper‑V support verifying the exact IGVM loader input before any guest virtual processor runs?

On Windows 11 Pro build 26300.9974, with vmwp.exe version 10.0.26100.9949, is there a documented, supported Hyper‑V interface that lets a host application authorize one cold start of a Linux VM with a specific IGVM image?

The application has the approved image length and SHA‑256. It can hash a file before requesting startup, but Hyper‑V may subsequently resolve the configured path and open the image itself. We need Hyper‑V to verify the exact bytes passed to its firmware loader, bind that decision to the intended VM, the one-time start request, and the effective VM configuration, and prevent every guest virtual processor from entering execution if that binding is lost.

The case we need to distinguish is a host application crash immediately after it submits the start request. Which Hyper‑V component, if any, can retain and enforce the binding independently of that application? What documented result can a replacement process retrieve to distinguish a refusal before the first VP entry from a VM that ran briefly and later returned to Off?

If this is supported, please identify the interface, link its documented guarantees, and specify any edition, build, hardware, or isolation-mode requirements. If Windows client Hyper‑V supports only part of this sequence, identifying where the documented guarantee ends would answer our question.