So we need to know what Citrix client versions are connecting to our apps. Turns out to be quite do-able:
In Citrix Access Management Console, I select the "Servers" node in our farm, and change the view to "Users". Then select "Choose Columns" and select to display "Client Build Number" - here's one I prepared earlier:

You can them use this handy chart to determine which actual version (9, 10, whatever) these numbers represent. What could be simpler?