ipv4_netmask_suffix

This parameter is string-only. In permissive mode — the default — almost every field arrives as a dynamic, so passing one works because Berserk injects asstring: extract-or-null, the value when it really is a string and null otherwise, so the call yields null (a predicate yields false). A property bag or array is therefore not matched, and tostring() is never applied implicitly — use it explicitly to match a bag's JSON text, keys included. Strict mode rejects the dynamic instead of coercing it. See String coercion and the asXXX family.