Which strategy guarantees reproducible Racket environments without a lockfile?

Goal

Build a repeatable Racket development setup that consistently loads the same package versions across different machines.

Constraints

The current raco pkg tool does not generate a lockfile; it only records exact versions in pkginfo.rktd, and transitive dependencies are not pinned automatically. Manual version specification in info.rkt or using --no-deps is error‑prone, while a shared pkgs/ directory relies on raco setup --link-only, which is not officially documented as a reproducibility feature.

Uncertainty

It remains unclear which approach best balances reproducibility, maintenance overhead, and compatibility with future Racket releases.

Questions

• Which strategy—manual version pinning, a shared pkgs/ directory, or a custom lockfile—most reliably ensures identical package sets across environments?
• Can the pkginfo.rktd file be treated as a de facto lockfile, and what are the risks of using it alone?
• What impact does relying on raco setup --link-only have on build reproducibility when the underlying Racket runtime updates?