I know that about /tmp. I know devenv too. By the way, have you ever noticed that the *env libc functions only allow accesses to env files with names of length 100 - strlen("/env/") - sizeof '\0', while rc allows names of up to 256 characters? I'm not too concerned about that one, just saying it's inconsistent. Rio is hardcoded for a maximum of 100 windows and I don't think anyone's ever had a problem.
A more realistic one is: rc doesn't go out to /env every time a variable is accessed. If they're changed underfoot the only way rc can see them is if you start up a new rc (like the rc under EXAMPLES in pipefile(1)) What's the reason for this, just speed? It seems weird to me that a Plan 9 program would do something "intelligent" like that (and therefore less predictable, like ls's that do isatty on /fd/1).