What are your comments, experiences, and recommendations about the placement of *.fex?

We are migrating from WF532 on one server to WF716 on a different server and are 'biteing the bullet' and reorganizing our environment after 8 years of haphazar growth. Several different organizational protocalls are being considered and we're asking the community's opinions of them.

Reports are by RCaster, with e-mail distribution; by MRE, for a very restricted set of users (>5); Directly from URLs on the corporate site using WFServlet; and by Dashboard, our preferred way going forward.
Development is by 2-3 persons, with DevStudio.
We use APPPATH to find objects and set 'edasprof.cfg's for MRE users, and always run RCaster with its own UserID and profile.

We prefer to keep 'production' procedures protected inside the '...\ibi\apps\' library structure accessable only to the developers, and organized into libraries based on business function: Finance, Sales, Purchasing, Executive, HR, etc. Because Dashboard reports are tied to MRE, we've decided to keep a 1:1 correspondance between apps libraries and MRE domains with exceptions for Developer "sandboxes" and apps libraries of things shared by two or more business functions.

We've implemented security via Active Directory so that authorized users get to WF and their network IDs seamlessly become their WF IDs.
For maintenance reasons we don't want to get involved with many WF UserProfiles, except where absolutely necessary, as with RCaster mentioned previously. MRE's Users and Groups secures MRE sufficiently, and Developers are trusted with full access to all apps libraries.

Our concern with *.fex placement is to put code where it makes the most 'sense' and avoid duplicating the code in multiple places; and all the maintenance problems which that leads to.

Placement of some things seems obvious, but other considerations make matters not so simple.
- RCaster procedures go into their respective apps libraries. Developers create, maintain, and schedule them. Users don't see them because they get e-mails or Dashboard viewing. But what about the odd report that someone needs to run off-schedule? It can be triggered from our web site via WFServlet, but if it's needed on a dashboard, then it must be in MRE. Do we place the *.fex in apps and a "-INCLUDE" in MRE, or put the *.fex into MRE and point the RCaster schedule and URL there? How do we secure or hide a Domain *.fex against tampering by authorized domain or dashboard users?
- Everything for a Dashboard must be in MRE, and this leads to the same visibility, security, and "-INCLUDE" question mentioned above.
- What about the report that's needed by multile business functions? We don't want to duplicate the *.fex, so how do we handle a later arriving group of users?

Does anyone have experience that could help us decide the rules for placement of *.fex? What haven't we imagined that you've experienced? Does WF have capabilities we don't knnow about that can make these decisions easier?