This was from memory, so don't take it as gospel as far as the current security-fix-only branches go, but here's what I sent to Larry:

-----------------
We maintain two independent heads in hg: 2.7 and default

3.2 is open for general bugfixes

2.5 (IIRC), 2.6 and 3.1 are open for security fixes

Security fixes (if applicable to both heads) go:
2.5 -> 2.6 -> 2.7
3.1 -> 3.2 -> default

General bug fixes (if applicable to both heads) go:
2.7
3.2 -> default

New features are added to default only

The relative ordering of 2.x and 3.x changes doesn't really matter -
the important thing is not to merge them in *either* direction. I
think you can theoretically do cherry-picking with Hg, but most people
seem to just do independent commits to the two streams.
-----------------