OpenStack projects which follow the release cycle use a branching model close to the NVIE model that ensures an almost-always-open master while still allowing to freeze features and select bugfixes in release branches (one per cycle). Some follow a model with development milestones and a final release at the end of the cycle, while some follow an alternative model which allows for multiple intermediary releases in every cycle.
Model with milestones
Here is how it works. Suppose that we are currently in the foo development cycle, which will lead to the final x.0.0 release. When we hit the foo-1 development milestone, we push a x.0.0.0b1 tag on the master branch. Same for the foo-2 development milestone. When we hit foo-3, we push a x.0.0.0b3 tag, and we start a feature-frozen period, during which the focus switches to fixing release-critical bugs. When all those bugs are fixed, we push a x.0.0.0rc1 tag and publish the first "foo" release candidate for that project. At this point we create a stable/foo pre-release branch. The master branch is no longer feature-frozen: it is now open for the next cycle (foo+1) development. If further release-critical bugs are found in the release candidate, we backport the release-critical bugfixes to stable/foo, and when we fix all new release-critical bugs, we tag a new RC. On release day, we tag the current RC as the final release (x.0.0). From that point on stable/foo is managed by the Stable Team and gets critical bugfixes backported and will regularly tag and publish point releases (the first one being x.0.1) until it reaches end-of-life.
Model with intermediary releases
In this model, releases are made at-will during the "foo" development cycle, incrementing a SemVer (major.minor.patch) version number based on the changes in the previous release. When we get to the end of the development cycle, the team proposes a release to be the "final" foo release. At this point we create a stable/foo branch, managed by the Stable Team, which can get critical bugfixes backported. Future stable point releases will be tagged on that branch, until it reaches end-of-life. Future releases on master must increment at least the 'y' semver component (x.y+1.0) to make room for those point releases.