Sorry about that, I accidentally pressed enter when creating the issue.
When I specify a "protect" rule on the command line, all works smoothly. I.e.
rsync --filter "P myfile.db" -POuhimrtyz --delete -n . user@host:~
But when I specify it in a file (e.g. .rsync-filter):
rsync -F -POuhimrtyz --delete -n . user@host:~
The filter file needs to be on the destination server in order to affect an incremental delete. If the destination may not have its filter files up-to-date (and you don't want to do a transfer of just the filter files first, before the main content), then use --delete-after.