scan (/keep) and negation of rules