hub v0.155.0: the floor can never deliver a withdrawn controller build (R-1085); RomM/Ghost evidence

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/cmd/hub/main.go

@@ -252,6 +252,12 @@ func main() {
 	// Phase 2 managed updates: seed the global controller-version floor fallback (config/env). A
 	// hub_settings row set via the operator UI overrides this at runtime.
 	dataStore.SetDefaultMinControllerVersion(cfg.ControllerUpdates.DefaultMinVersion)
+	if reason, spoiled := store.SpoiledControllerTag(cfg.ControllerUpdates.DefaultMinVersion); spoiled {
+		// R-1085: the config/env default is the one floor no form checks — ResolveManagedFloor holds it at serve
+		// time; say so at start, where whoever set it will look.
+		logger.Printf("[WARN] Default controller-version floor %s is a WITHDRAWN controller build (%s) — it is HELD for every box (R-1085)",
+			cfg.ControllerUpdates.DefaultMinVersion, reason)
+	}
 	if cfg.ControllerUpdates.DefaultMinVersion != "" {
 		logger.Printf("[INFO] Default controller-version floor: %s", cfg.ControllerUpdates.DefaultMinVersion)
 	}