In package.xml 1.0, stability was known as "state" which is not the most accurate description. package.xml 2.0 introduces the term stability and like version splits the concept of stability into two components, release and api.
The release stability is the same familiar state from package.xml 1.0. It can be one of:
snapshot - a frozen picture of development at a particular moment
devel - a very new non-production release. Devel should be used for extremely new, practically untested code.
alpha - a new non-production release. Alpha should be used for new code that has an unstable API or untested code.
beta - a non-production release. Beta should be used for code that has a stable API and is nearing a fully stable release. Regresion tests and documentation should exist or soon follow to qualify as a beta release. Release candidates should use the beta stability.
stable - a production release. Stable releases must have a stable API, and must have regression tests and documentation.
The API stability is informational only - the installer does not use it.