OTP patch pinning vs minor-line floating with .tool-versions and mix.lock
Our Elixir project commits a .tool-versions file (used via asdf/mise) and mix.lock so every developer and CI runner builds with the same toolchain and dependency set. The dependency side is settled: the lockfile pins exact Hex versions and checksums. The unresolved decision is how tightly to pin Erlang/OTP relative to Elixir. Each Elixir release supports a d