Which nixpkgs commits go to a stable channel?

I’m trying to better understand how the channel system works. I understand that nixpkgs-unstable is a git branch, which is branched off master if some tests on hydra succeed. However, stable channels such as nixos-19.09 are stable, in that no major version upgrades are supposed to go there. How is this enforced or implemented in practice? How a bugfix commit makes its way to nixos-19.09 but a major update not?

There are separate branches (release-19.09) and bugfixes are (hopefully, most of the time) cherry-picked manually. Also see Nixpkgs: flow from master to channel.