diff --git a/001_apt-sources.sh b/001_apt-sources.sh
index 17d0f9d..e6bb7c0 100755
--- a/001_apt-sources.sh
+++ b/001_apt-sources.sh
@@ -17,15 +17,24 @@ TRANSPORT="https"
 #MIRROR=deb
 #MIRROR=pkgmaster
 MIRROR=deb
+MERGED_URI="${TRANSPORT}://${MIRROR}.devuan.org/merged/"
+DEVUAN_URI="${TRANSPORT}://${MIRROR}.devuan.org/devuan"
 ACTIVE=/etc/apt/sources.list.d
 AVAILABLE=/etc/apt/sources.list-available
 mkdir -p "${AVAILABLE}"
 
 SECTION=(main contrib non-free non-free-firmware)
+
+# For standard merged suites (main contrib non-free non-free-firmware)
+SECTION_MERGED="main contrib non-free non-free-firmware"
+#
+# For experimental / proposed (usually just main)
+SECTION_SPECIAL="main"
+
 # ACTIVE_LIST=('freia')
 # ACTIVE_LIST=('freia' 'freia-security' 'freia-updates' 'freia-backports')
-ACTIVE_LIST=('excalibur')
-ACTIVE_LIST=('excalibur' 'excalibur-security' 'excalibur-updates' 'excalibur-backports')
+# ACTIVE_LIST=('excalibur')
+# ACTIVE_LIST=('excalibur' 'excalibur-security' 'excalibur-updates' 'excalibur-backports')
 # ACTIVE_LIST=('daedalus')
 # ACTIVE_LIST=('daedalus' 'daedalus-security' 'daedalus-updates' 'daedalus-backports')
 # ACTIVE_LIST=('chimaera' 'chimaera-security' 'chimaera-updates' 'chimaera-backports')
@@ -38,79 +47,111 @@ OTHER_LIST=('experimental')
 
 SECTION=(main contrib non-free non-free-firmware)
 ACTIVE_LIST=('excalibur' 'excalibur-security' 'excalibur-updates' 'excalibur-backports')
-INACTIVE_LIST=('ascii' 'ascii-security' 'ascii-updates' 'ascii-backports')
 
-echo ${#ACTIVE_LIST[@]}
+# New: proposed-updates suites (disabled by default - production risk)
+PROPOSED_LIST=('excalibur-proposed-updates')
+
+# Active (enabled) loop – all merged in your current choice
 for RELEASE in "${ACTIVE_LIST[@]}"; do
-    echo "${RELEASE}"
-    bash -c "cat > ${AVAILABLE}/devuan_${RELEASE}.sources" <<-EOF
-        Enabled: yes
-        Types: deb deb-src
-        URIs: ${TRANSPORT}://${MIRROR}.devuan.org/merged/
-        Suites: ${RELEASE}
-        Components: ${SECTION[*]}
-        Architectures: amd64
-        EOF
-    ln -sf "${AVAILABLE}"/devuan_"${RELEASE}".sources "${ACTIVE}"/devuan_"${RELEASE}".sources
+  echo "${RELEASE}"
+  bash -c "cat > ${AVAILABLE}/devuan_${RELEASE}.sources" <<-EOF
+	Enabled: yes
+	Types: deb deb-src
+	URIs: ${MERGED_URI}
+	Suites: ${RELEASE}
+	Components: ${SECTION_MERGED}
+	Architectures: amd64
+	EOF
+  ln -sf "${AVAILABLE}/devuan_${RELEASE}.sources" "${ACTIVE}/devuan_${RELEASE}.sources"
 done
 
-echo ${#INACTIVE_LIST[@]}
-for RELEASE in "${INACTIVE_LIST[@]}"; do
-    echo "${RELEASE}"
-    bash -c "cat > ${AVAILABLE}/devuan_${RELEASE}.sources" <<-EOF
-        Enabled: no
-        Types: deb deb-src
-        URIs: ${TRANSPORT}://${MIRROR}.devuan.org/merged/
-        Suites: ${RELEASE}
-        Components: ${SECTION[*]}
-        Architectures: amd64
-        EOF
+# Special / other (experimental, and potentially *-proposed-updates later)
+for RELEASE in "${OTHER_LIST[@]}"; do
+  echo "${RELEASE}"
+  bash -c "cat > ${AVAILABLE}/devuan_${RELEASE}.sources" <<-EOF
+	Enabled: yes
+	Types: deb deb-src
+	URIs: ${DEVUAN_URI}
+	Suites: ${RELEASE}
+	Components: ${SECTION_SPECIAL}
+	Architectures: amd64
+	# Signed-By: /usr/share/keyrings/devuan-archive-keyring.gpg  # optional, if needed
+	EOF
+  ln -sf "${AVAILABLE}/devuan_${RELEASE}.sources" "${ACTIVE}/devuan_${RELEASE}.sources"
 done
 
 echo ${#OTHER_LIST[@]}
 for RELEASE in "${OTHER_LIST[@]}"; do
-    echo "${RELEASE}"
-    bash -c "cat > ${AVAILABLE}/devuan_${RELEASE}.sources" <<-EOF
+  echo "${RELEASE}"
+  bash -c "cat > ${AVAILABLE}/devuan_${RELEASE}.sources" <<-EOF
         Enabled: yes
         Types: deb deb-src
         URIs: ${TRANSPORT}://${MIRROR}.devuan.org/devuan
         Suites: ${RELEASE}
         Components: main
         Architectures: amd64
-        EOF
+EOF
 done
 
-# ONION="devuanauxrkggcowgm2vcs6go3c5pgxdidd5wqjpg7zpfaxkmgspr6id.onion"
-# TRANSPORT="tor+http"
-#
-# for RELEASE in "${OTHER_LIST[@]}"; do
-#     echo "${RELEASE}"
-#     bash -c "cat > ${AVAILABLE}/devuan-onion_${RELEASE}.sources" <<-EOF
-#         Enabled: yes
-#         Types: deb deb-src
-#         URIs: ${TRANSPORT}://${ONION}/merged/
-#         Suites: ${RELEASE} ${RELEASE}-updates ${RELEASE}-security
-#         Components: ${SECTION[*]}
-#         Architectures: amd64
-#         EOF
-# done
+# ────────────────────────────────────────────────
+# Proposed-updates loop (disabled by default)
+# ────────────────────────────────────────────────
+echo ${#PROPOSED_LIST[@]}
+for RELEASE in "${PROPOSED_LIST[@]}"; do
+  echo "${RELEASE}"
+  bash -c "cat > ${AVAILABLE}/devuan_${RELEASE}.sources" <<-EOF
+	Enabled: no
+	Types: deb deb-src
+	URIs: ${DEVUAN_URI}
+	Suites: ${RELEASE}
+	Components: ${SECTION_SPECIAL}
+	Architectures: amd64
+	# Note: proposed-updates for upcoming point releases; not for production
+	EOF
+  # Optional symlink even if disabled
+  ln -sf "${AVAILABLE}/devuan_${RELEASE}.sources" "${ACTIVE}/devuan_${RELEASE}.sources"
+done
 
-#bash -c "cat > ${AVAILABLE}/saltstack.list" <<EOF
+# Onion setup (uncomment/adapt as needed)
+ONION="devuanauxrkggcowgm2vcs6go3c5pgxdidd5wqjpg7zpfaxkmgspr6id.onion"
+TOR_TRANSPORT="tor+http"
+TOR_MERGED_URI="${TOR_TRANSPORT}://${ONION}/merged/"
+TOR_DEVUAN_URI="${TOR_TRANSPORT}://${ONION}/devuan"
+
+# Which suites get onion variants? (e.g. active + experimental/proposed)
+# You can make ONION_LIST=("${ACTIVE_LIST[@]}" "${OTHER_LIST[@]}" "${PROPOSED_LIST[@]}")
+ONION_LIST=('excalibur' 'excalibur-security' 'excalibur-updates' 'excalibur-backports' 'experimental' 'excalibur-proposed-updates')
+
+# ────────────────────────────────────────────────
+# Onion / Tor variants (optional - create separate files)
+# ────────────────────────────────────────────────
+# Uncomment the block below if you want Tor variants generated
 #
-#deb http://debian.saltstack.com/debian stretch-saltstack main
-#EOF
-#ln -sf "${AVAILABLE}"/saltstack.list "${ACTIVE}"/saltstack.list
-#
-#
-## the docker packages have go over to systemd so these wont install
-#bash -c cat > "${AVAILABLE}"/docker.list <<EOF
-#
-## Debian stretch
-#deb http://apt.dockerproject.org/repo debian-stretch main
-#EOF
-#ln -sf "${AVAILABLE}"/docker.list "${ACTIVE}"/docker.list
-#
-##apt update && apt install -y --force-yes devuan-keyring
+echo "Generating onion variants for: ${ONION_LIST[*]}"
+for RELEASE in "${ONION_LIST[@]}"; do
+  echo "${RELEASE} (onion)"
+
+  # Decide URI based on suite type (same logic as clearnet)
+  if [[ "$RELEASE" == *proposed-updates || "$RELEASE" == "experimental" ]]; then
+    TOR_URI="${TOR_DEVUAN_URI}"
+    SECTION_USED="${SECTION_SPECIAL}"
+  else
+    TOR_URI="${TOR_MERGED_URI}"
+    SECTION_USED="${SECTION_MERGED}" # assume you defined SECTION_MERGED earlier as "main contrib non-free non-free-firmware"
+  fi
+
+  bash -c "cat > ${AVAILABLE}/devuan_${RELEASE}-onion.sources" <<-EOF
+	Enabled: no          # change to yes if you run tor and want default onion
+	Types: deb deb-src
+	URIs: ${TOR_URI}
+	Suites: ${RELEASE}
+	Components: ${SECTION_USED}
+	Architectures: amd64
+	# Tor / onion routing - requires apt-transport-tor installed and tor running
+	EOF
+
+  ln -sf "${AVAILABLE}/devuan_${RELEASE}-onion.sources" "${ACTIVE}/devuan_${RELEASE}-onion.sources"
+done
 
 rm /etc/apt/sources.list