What does this CAN bus waveform mean?
Turns out the answer should have been obvious from the waveforms above.
When TX goes low, so does RX. But when TX goes high, RX takes more than 1us to rise again. That's more than a whole bit time! CAN cannot work under these conditions.
The reason RX lags behind TX would have been obvious with a proper oscilloscope, rather than a simple logic analyser. Since the bus was so short, I didn't bother to add the termination resistors, because I didn't think reflections would be a problem. But the resistors are also important for discharging the slight capacitance of the bus, allowing it to transition from dominant back to recessive fast enough.
Soldering on the resistors magically made whole CAN messages appear.