Where is the virtual port that connects an SSID to hardware?

Installing and Using OpenWrt Network and Wireless Configuration
1

Problem
I'm struggling to get a cap ac ( 22.03, non-DSA) to bridge multiple ssid/vlans to my hEXs (22.03).
My other AP's are controlled by capsman and run fine. But I dislike mikrotik's haphazard choices, instead want to run openwrt exclusively to ultimately implement openWisp.

What I tried
I prolly flashed the firmware 30 times getting nowhere. I tried to translate swconfig solutions from non-ipq4019 architectures but getting nowhere.
The cap ac being powered thru its wan port (eth0.2) appears to be the great distinction with all the recipes I found. I also found a L3 solution but I want L2 : trunk the SSID's to the router.

Should I Tag an SSID -or- PVID its virtual port
In capsman when you provision an SSID, you can actually "tag the SSID", in my case with vlan15". Although I dislike MT, tagging an SSID is a strong concept.

But in openwrt, where do you tag the SSID ?

In the Switch section you have to trunk vlan15 on the WAN port (eth0.2) .
Then define a new Bridge device that contains said switch-vlan (but in my mind this is only the outbound port towards my managed switch. Where is the virtual port that connects the SSID with the physical AP, for frames inbound from SSID ?)
Then define an unmanaged Interface containing said bridge.
Then define an SSID that refers to said Interface. If you try to .15 the Interface in the wireless section, luci complains about UCI standards. So much for tagging the SSID.

What I'm missing is that "virtual port" that connects the SSID to the AP so I can PVID it with "15" and untag it with "15". ( Incidentally, the WAN port on cap ac has pvid 2 but I tag all vlans anyway).
Or how you to tag an SSID.

thanks for pointing out my delusion.

2

Only the egress traffic leaving the wired interface is tagged.
The ingress traffic is classified as belonging to a VLAN, based on the VLAN tag in the frame (if any).

Here is an example of how to tag the frames (leaving the AP wired port) belonging to SSIDs 15 and 20 with the corresponding VLAN IDs.

Port 4 is the cAP ac LAN labeled port, so you should use this port to connect to the upstream router.
If you want to use the WAN port, change the port number to 5 in the switch_vlan sections.

# /etc/config/network

config device
        option name 'br-vlan15'
        option type 'bridge'
        list ports 'eth0.15'

config device
        option name 'br-vlan20'
        option type 'bridge'
        list ports 'eth0.20'

config interface 'vlan15'
	    option proto 'none'
	    option device 'br-vlan15'

config interface 'vlan20'
	    option proto 'none'
	    option device 'br-vlan20'

config switch_vlan
        option device 'switch0'
        option vlan '15'
	    option vid '15'
        option ports '4t 0t'

config switch_vlan
        option device 'switch0'
        option vlan '20'
	    option vid '20'
        option ports '4t 0t'

# /etc/config/wireless

config wifi-iface 'wifinet15'
        option ssid 'SSID15'
	    option mode 'ap'
        option network 'vlan15'
	...

config wifi-iface 'wifinet20'
	    option ssid 'SSID20'
        option mode 'ap'
        option network 'vlan20'
	...