I only tested on the puppet server.
If I set simp_options::selinux: true (default for simp) and set selinux::ensure: permissive in hiera in the host/puppt file it stays enforcing. If I manually change it to permissive, it stays permissive even when switched to enforcing.
This only happens on 6.9. 7.3 works fine.
Tested on system built on 9.5.2017 with selinux module 2.1.1 (Miller's fixes for autorelabel, but we think it existed before that fix.)
I tested again and it appears I was mistaken, or the problem was fixed between early sept and late october.