Ok, that (finally!) makes sense, including explaining why forcing a
retransfer from the secondary's side with `rndc retransfer` fixes the
problem, since retransfer almost certainly does AXFR.  Thanks Anand!

Remains the question of whether the cause was Knot generating a bad
IXFR or BIND9 failing to purge data from a partial IXFR.
--