What does this CAN bus waveform mean?

Turns out the answer should have been obvious from the waveforms above.

When TX goes low, so does RX. But when TX goes high, RX takes more than 1us to rise again. That's more than a whole bit time! CAN cannot work under these conditions.

The reason RX lags behind TX would have been obvious with a proper oscilloscope, rather than a simple logic analyser. Since the bus was so short, I didn't bother to add the termination resistors, because I didn't think reflections would be a problem. But the resistors are also important for discharging the slight capacitance of the bus, allowing it to transition from dominant back to recessive fast enough.

Soldering on the resistors magically made whole CAN messages appear.

There is nothing magic about the terminating resistors. They are absolutely required for a CAN bus. They may be called "terminating" resistors, and this is indeed part of their function when the bus is long enough to be a transmission line. However, they also cause a unloaded bus to go to the recessive state, which is a fundamentail assumption the CAN protocol is based on.

Think of CAN as a passively pulled up open collector bus, except that it's implemented as a differential pair (usually). The terminating resistors not only terminate the transmission line, but also act as the pullup resistor. In the differential CAN implementation, they are really pull-together resistors, but logically have the same function as a pullup on a single ended open-collector bus.

Note that the CAN standard does not specify the actual physical bus. For short distances on the same board at the right bit rates, you can implement can as a single-ended passively pulled up bus. Unless you are doing something special, using two CAN transceiver chips to go between only two nodes 3 inches apart on the same board is gross overkill and a waste of money, power, space, and parts.