The permissive standard I was specifically referring to was the IEEE 802.1Q standard. You can sign up to get access to the latest standard, there is also an old 2003 version of the IEEE 802.1Q spec in pdf format here; in the referenced 802-1Q-2003.pdf document, see E.2.2 Consistent view of the "untagged VLAN(s)" on a given LAN segment on page 293 and 8.9 VLAN classification on pages 51-52. Note that VLAN classification will always use the vlan specified by the tag (as long as the port is a member of the vlan and the frame is not filtered out), otherwise if there is no explicit vlan specified, then it will either be classified by the PVID or by protocol/mac classification. There is nothing that prevents a frame tagged for vlan 1 being classified into vlan 1 if the pvid is 1. However, the single format rule specified in Note 4 of 7.5 Ingress, Forwarding, and Egress Rules on pages 29-30 states that for a specific vlan, a specific bridge port is required to always transmit frames for that vlan using the same format. That seems to me to say that the bridge is not allowed to remember how the frame was received, and therefore not able to transmit as it was received (i.e. tagged or untagged) in the general case. The following is what The single format rule says:
Frames transmitted on a given LAN segment by a VLAN-aware Bridge for a given VLAN shall be either
d) All untagged; or
e) All VLAN tagged with the same VID.
NOTE 4—In other words, a Bridge can transmit untagged frames for some VLANs and VLAN-tagged frames for other
VLANs on a given link, but cannot transmit using both formats for the same VLAN. The single format rule only applies
to the frame transmission behavior of individual VLAN-aware stations; i .e., it does not express a requirement for a
Bridge to police the behavior of the other stations attached to a segment and enforce a single format.
So the standard "allows" one side to send a specific vlan tagged and the other side to send the same vlan untagged (in which case the PVID would be the same as the tag specifies). But that can lead to confusing situations as you have discovered, and configuring it that way is discouraged.
The normal method of avoiding the confusion is to not use vlan 1 for data, either user data or management data. If you want untagged traffic use a pvid other than 1. The other option is to filter based on frame type.
This part of the MikroTik ROS documentation is worth reading Management access configuration and the "Attention" section just above VLAN Example - InterVLAN Routing by Bridge
Another problem is that there is not a consistent meaning for terminology by different vendors. Take for example "hybrid". Here is what HP's definition from this document Introduction to port-based VLAN is: (and it is different than MikroTiks definition, and what MikroTik refers to as hybrid, most other vendors refer to as trunk (possibly with one untagged vlan allowed). HP's definition allow multiple vlans to be untagged. How those multiple vlans are classified on receiption is not specified, but it could be protocol or mac based, or perhaps an asymmetric vlan.
Hybrid port—A hybrid port allows traffic of some VLANs to pass through untagged and traffic of some other VLANs to pass through tagged. Usually, hybrid ports are configured to connect devices whose support for VLAN-tagged packets you are uncertain about. As shown in Figure 5, Device C connects to a small-sized LAN in which some PCs belong to VLAN 2 and other PCs belong to VLAN 3, and Device B is uncertain about whether Device C supports VLAN-tagged packets. On Device B, configure the port connecting to Device C as a hybrid port to allow packets from VLAN 2 and VLAN 3 to pass through untagged.