Well I meant permissive on install was better than disabled on
install, but certainly if you are using stock packages enforcing on
install is the way to go. that said I have run into situatiions where
the contextes werent right out of the box on some packages especially
when I've done kickstarts from internal repos which include the
updates.

You are mostly right about fixfiles except if you run "fixfiles -F
restore /path" it will do the same thing as "restorecon -R /path".
That said I often create custom directories for applications where I
dont agree with the default locations and "fixfiles relabel" is a very
easy way to make those changes perminent. a common example of this is
with PostgreSQL I always create a table space in a subdirectory on a
dedicated partition. in this case I set the context on the directory
with chcon then do a "fixfiles -F relablel" then every thing is happy
:-).
essentially the thing I like the most about fixfiles