move key WQL restrictions from WHERE/IN to JOIN

"not" is the only place we're using negation (surprise!).  As planned, the approach is to use a LEFT JOIN and then negate in the WHERE clause.