Rules are evaluated top to bottom and evaluation stops at the first clause whose if, changes, or exists condition matches. That clause's when decides the outcome. Later clauses are never considered, so ordering is semantic, not cosmetic.
If no clause matches, the job is not added to the pipeline at all. This differs from a matching clause with when: never, which is also an exclusion but reached deliberately. The practical effect is the same, but the debugging path differs: a job missing because nothing matched gives no signal anywhere.
A clause with only a when and no condition always matches and acts as a catch-all, which is why - when: on_success as a final entry is a common idiom. Note that changes is unreliable outside merge request pipelines: on a branch pipeline with no prior pipeline for comparison, or on the first pipeline for a new branch, changes evaluates true for everything. Pair it with an if restricting the rule to merge request pipelines.