Would it be worth mentioning here that Only rules have to all be satisifed for the fragment to be included, and in case of Except it's just one? For example the following fragment will always be included if environment is live (it doesn't matter whether SS_DATABASE_SERVER is defined or not):

Except:
  environment: dev
  constantdefined: SS_DATABASE_SERVER