pleased wrote

I think a "loop" would occur if, say, my router repeated ARP packets sent into its single LAN port out the same port. It's not doing that, is it?

To answer, I would need to know little more such as subnets you are using.

Anyway, I have internet connectivity on ports with the same PVID as the router port's and those with (multiple) different PVIDs.

Of course, yes. Incoming packets without a tag are assigned to the default VLAN and every port is a member of it in your setup. Can you ping from a system in Home to a system in Apartment? If so, there is no isolation, this are no longer VLANs.

What you try to do (ports 2-6 = Home, 7+8 = Apartment, port 1 in both, Home and Apartment and also in - let's call it - Internet, all ports 1-8 in Internet) is indeed possible - but not with TL-SG108E.

It is called private VLANs or PVLANs - you have a primary VLAN ( Internet) and two secondary VLANs ( Home, Apartment). The ports in the secondary PVLANs can be ' community' or ' isolated'. 'C ommunity' ports can reach each other (either Home or Apartment) and the ' promiscuous' router port ( Internet), while ' isolated ports' can only talk to the ' promiscuous' port. The packets get tagged with the PVID, but the tags never go out to any port.

See this article for more information: http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/CLIConfigurationGuide/PrivateVLANs.html

I'm not sure, but the more expensive TP-Link switches could probably handle PVLANs, too. But PVLANs have nothing to do with 802.1Q VLANs - they have been designed to connect a company's private network in distant offices with several VLANs over an isolated, big ISP-provided VLAN spanning public networks if I understand it correctly. Hence their name. AFAIK they put a tagged Ethernet frame into another tagged Ethernet frame, but I didn't elaborate more on this somewhat weird technique. ;)

I would suggest to use a classic 802.1Q trunk to achieve what you want with TL-SG108E. Should be possible with every Internet router, which provides 802.1Q trunks or at least two subnets on two LAN ports.

pleased wrote

The only thing I can think of so far is that, when the SG108e transfers a packet to my router "across PVIDs", it does something to the packet to cause the router to send a broadcast in response.

Yes, this was my first thought, too. Any broadcast request from the router would be sent to all ports b/c they are all in VLAN 1. According to the TP-Link docs, an untagged packet on a tagged port (remember: all ports assigned to more than one VLAN are tagged ports) will get the PVID of the ingress port, but will be forwarded with the PVID of the egress port (again all ports, b/c they are also a member of the VLAN 1).* Result are blinkenlights for every broadcast of any device. Is this plausible?

* See table below for PVID handling - it's from the first edition of T1600G's User's Guide, which has been replaced already by another version - I saved it for reference. Since the TL-SG108's UG is very sparse, I take this as reference. I think that the OS of the switches is almost the same for Easy Smart and Smart/Managed switches.

Just guessing by my gut feeling. ;) To proof, I would have to set up this scheme and analyze it, like you could do too. It would probably be easier to just set up a trunk port, but if I have some time tomorrow, I probably will test it if you think it makes sense. But I have Unix systems only and they don't send as much broadcasts as Windows does, so my LEDs would probably blink with somewhat slower frequency (no kidding).

Before doing so, please could you test it with just one computer connected to the switch and the switch to the router to see if something changes (frequency of blinking, for example)?

Trunk is not an expirement, it's the only way to connect two or more VLAN networks to a third network outside of the TL-SG108E.
I will test tomorrow (or better: today, it's already Tuesday here) with my switch and we'll see whether I can reproduce this behaviour.

Yes, the PVID handling seems confusing a bit, but it is what this switch does according to the docs.
For configuration, I would just set up the switch like you described.