How to configure vlan using the switching chip on RB951G-2HnD?

Question

Mikrotik

The task is to configure RB951G-2HnD in smartswitch mode and get wirespeed.
I can’t get tagged packets with VLAN ID 1001 from the ether2 port.
And also assign an IP for management to ether3 VLAN ID 1.
With all this, it seems like it turned out to create a hybrid vlan on ether3, tagged packets with VLAN ID 16 fly there and VLAN ID 777 as well as untagged traffic from VLAN ID 1.
I can't understand the logic of the "leave-as-is" and "add-if-missing" packet header parameters, did I specify them correctly in this case?
A diagram for a better understanding of what needs to be achieved:
1-port receives untagged traffic and adds a VLAN ID 1001 tag to it. And when it is sent from the port, it removes the tag. This is our Access port
Port 2 receives and sends tagged traffic with VLAN ID 1001. This is our trunk port.
The 3rd port receives and sends tagged traffic with VLAN ID 16, 777 and untagged traffic with VLAN ID 1. This is our hybrid port.
The 4-port receives and sends untagged traffic by removing the tag from VLAN ID 777. This is our Access port.
The 5-port receives and sends untagged traffic by removing the tag from VLAN ID 777. This is our Access port.

/interface ethernet
set ether1 master-port=ether5
set ether2 master-port=ether5
set ether3 master-port=ether5
set ether4 master-port=ether5
 
/interface ethernet switch vlan
add ports=ether3,switch1-cpu switch=switch1 vlan-id=1
add ports=ether3 switch=switch1 vlan-id=16
add ports=ether1,ether2 switch=switch1 vlan-id=1001
add ports=ether3,ether4,ether5 switch=switch1 vlan-id=777
 
/interface ethernet switch port
set switch1-cpu vlan-mode=secure vlan-header=leave-as-is default-vlan-id=1
set ether1 vlan-mode=secure vlan-header=always-strip default-vlan-id=1001
set ether2 vlan-mode=secure vlan-header=add-if-missing default-vlan-id=1001
set ether3 vlan-mode=secure vlan-header=leave-as-is default-vlan-id=1
set ether4 vlan-mode=secure vlan-header=always-strip default-vlan-id=777
set ether5 vlan-mode=secure vlan-header=always-strip default-vlan-id=777

The question was solved by myself, here is the corrected version of the config can be useful to someone.

/interface ethernet
set ether1 master-port=ether5
set ether2 master-port=ether5
set ether3 master-port=ether5
set ether4 master-port=ether5
 
/interface ethernet switch vlan
add ports=ether3,switch1-cpu switch=switch1 vlan-id=1
add ports=ether3 switch=switch1 vlan-id=16
add ports=ether1,ether2 switch=switch1 vlan-id=1001
add ports=ether3,ether4,ether5 switch=switch1 vlan-id=777
 
/interface ethernet switch port
set switch1-cpu vlan-mode=secure vlan-header=leave-as-is default-vlan-id=1
set ether1 vlan-mode=secure vlan-header=leave-as-is default-vlan-id=1001
set ether2 vlan-mode=secure vlan-header=add-if-missing 
set ether3 vlan-mode=secure vlan-header=leave-as-is default-vlan-id=1
set ether4 vlan-mode=secure vlan-header=leave-as-is default-vlan-id=777
set ether5 vlan-mode=secure vlan-header=leave-as-is default-vlan-id=777

Answer 1

A hammer!