My cheap logic analyser has arrived and is proving illuminating:

- Screenshot from 2021-01-10 11-13-48.png (13.21 KiB) Viewed 25579 times
It appears to show that I am frequently, but not always, getting a spurious ninth pulse at the end of a low speed SPI byte.
Zooming in shows that the "ninth pulse" is not a single pulse, but a burst of eight pulses at high speed.

- Screenshot from 2021-01-10 11-18-20.png (13.02 KiB) Viewed 25579 times
Coming at the end of the intended low speed SPI transaction, it is presumably occurring when the Z180 is reading the result from the shift register in the CPLD. The way the CPLD is designed, reading the shift register using Z180 port 0x49 is supposed to trigger a high speed SPI transaction, while reading the register using port 0x48 should not.
The CPLD was working when tested using an RPi to emulate the Z180. But that was slow, in particular the port address was set up well before RD and IORQ went low, and maintained until well after RD and IORQ went high.
So my guess is that a timing issue is resulting in a false triggering of a high speed SPI transfer. I will have to review the VHD to see whether there is anything I can do about that. It will not be easy given that the current design has the CPLD almost 100% committed.
The issue only seems to occur when reading the receive shift register, not when writing the transmit shift register. Again, a write to port 0x49 should trigger a high speed transfer, while a write to 0x48 should not. Now the WR pulse occurs later in an I/O cycle than the RD pulse. This suggests that the timing issue is at the beginning of the read cycle, not the end.