Ok, that (finally!) makes sense, including explaining why forcing a retransfer from the secondary's side with `rndc retransfer` fixes the problem, since retransfer almost certainly does AXFR. Thanks Anand!
Remains the question of whether the cause was Knot generating a bad IXFR or BIND9 failing to purge data from a partial IXFR. --
