Each runner's TMPDIR is no longer a dot-led directory.
Redirecting TMPDIR away from the shared /var/folders temp is deliberate and stays: a job that leaks into the shared temp cannot be swept safely. Naming the target .tmp was incidental, and it silently breaks any tool applying dotfile-ignore rules to an absolute path rooted at os.tmpdir(). It fails by ignoring everything rather than erroring, which is how it went unnoticed through a machine-contention investigation and a timeout raised more than fourfold.
runpool clean sweeps both names, so an install predating this does not orphan its old directory, and retires the legacy one once empty.
Existing installs need runpool rewrite-agents; the environment lives in the launch agent and takes effect when the runners next restart.