Oh it’s confusing at first. And yes they’ll let you config asymmetric tagging if you want without warning.
The connection between “/interface/bridge/vlan tagged=bridge” and “/interface/vlan interface=bridge” is subtle. But in general you can avoid some of the “dynamic surprises” if you add all known VLANs to /interface/bridge/vlan statically (with bridge being tagged & other bridge ports needing tagging on the tagged= list too). If you have the VLANs added statically, then the dynamic vlan config is handy for access ports. e.g. if you frame-type=allow-untagged-… and pvid=, and this avoid a 2nd step of adding the port as untagged= in /interface/bridge/vlan section, since it’s dynamically added there. Same logic applies with dynamic wifi ports from CAPsMAN – if the VLAN is preset in /interface/bridge/vlan with tagged=bridge before CAPsMAN, things should work.
But certainly all confusing, even more so since CAPsMAN creating ports on top of all of this. There is a certain logic to it all, but simplify is sacrificed for flexibility.