Function committed_floor_exceeding 

pub fn committed_floor_exceeding(
    mls_group: &MlsGroup,
    own: &LibXMTPVersion,
) -> Option<String>

Returns the group’s committed MIN_SUPPORTED_PROTOCOL_VERSION floor when it exceeds own_version, reading ONLY the pre-commit AppData dict — committed, already-validated state.

This is the shared trigger for the “pause, don’t fork” guards on the xmtp_mls receive paths (process_message_with_app_data before dispatch; ValidatedCommit::from_staged_commit before interpreting migrated group state). It is deliberately blind to any floor bump carried by the commit currently being processed: that proposal has not passed the super-admin policy check yet, and a pause triggered by unvalidated input would let any member freeze the group permanently. The commit that raises the floor pauses below-floor receivers through the post-policy check at the end of commit validation instead. Consequence for protocol evolution: a release introducing a new wire format must land the group-floor bump in a strictly earlier commit than the first commit using that format.

Lenient on malformed state (non-UTF-8 floor bytes, unparseable semver ⇒ None), mirroring enforce_min_version_monotonicity’s treatment of malformed priors: garbage must never brick the group.