You hit on the neil. I restrained myself from asking those Q's. fsmithred, in my understanding some glich was
in amprola for ascii. Ideally ascii , -security & -updates have forked all pkg's, other than devuanised one,
from corresponding debian stretch repo's. Thease are empty due to some problem. So there was no
update && upgrade since last few weeks. Jessie( I don't have now) & ceres has no problem.
In no way pkg's from stretch security automatically should flow to -proposed-updates. The same were followed
for jessie from day one. Testing amprola & others will make repo's in order soon.

I can follow main three repo's for regular update && upgrade like old days.Packages from -backport have
ver. no. as 'bpo' & can be used with some salt. Have no idea about 'proposed'. I can assume that pkg's flow
from experimental to ceres to ascii after 10/20 days without major bug. Hope you will put some light on this.

"~deb9u1" is upgrade one of stretch pushed through stretch security (decleared on their site).That is why it is
upgradable. Other suits have not received updates, but only stable. Securiry patch will be provided only
on next upgrade of chromium for buster & sid (ceres).
You know that if chromium will be devuanised then 'devuan1' will be added next & ready for automatic update.
Any correction will be helpfull for devuan users.

Food for reading, man polkit & pkexec.      Late in the party.    Checked my ascii & ceres systems with DE's. Removed policykit-1-gnome & install lxpolkit ( ascii with lxde & xfce4). gparted & synaptic can't be launced from menu, but from terminal. In terminal it uses no graphical authentication. Same for mate-polkit (ceres with mate). In both system reinstalled policykit-1-gnome & reboot. Graphical authentication is back for both programs and also for mounting devices from file managers. 'pkexec' is provided by synaptic & gparted.'gksu' is maual install. Authentication via pkexec routed through 'polkit-agent-helper-1' which is provided by DE's. Without DM probably you need policykit-1. Different DE's have their own implementation. Should DM's & xorg run by users?

cheers,

May like the package ' xlennart' & also this https://www.youtube.com/watch?v=_cdEFF-ttLw / ' devuan is born '

cheers

@garyz.dev1-
My system was updated from devuan jessie, which was a clean install from devuan DVD installer. I only have
devuan ascii-updates & ascii-security, no backport or proposed.What is other choice? Dist-upgrade have given

rsyslog : Depends: liblognorm2 (>= 1.1.2) which is a virtual package. 
State: installed (8.4.2-1+deb8u2), upgrade available (8.14.0-2+devuan1.0)

Devuan community are really helpful.I know the dev's are pre-occupied and updates will be available when ready.
Devuan security updates probably come from Debian Security Advisory (DSA) published on debian main page.
These updates covers related CVE's for debian packages like firefox-esr, linux (kernel), chromium-browser,
postgresql ( @leloft ) etc. for respective suits.
I incorporated debian security repo. in my sources.list as

deb http://security.debian.org/ stretch/updates main contrib non-free 

and received few updates also last night including above first two packages. Ensured that does not include
devuan packages.This may not be the right way, but for time being ascii users may like this path.

Regards,