diff --git a/northd/ovn_northd.dl b/northd/ovn_northd.dl
index f1b7471f2..dd69126ff 100644
--- a/northd/ovn_northd.dl
+++ b/northd/ovn_northd.dl
@@ -1640,8 +1640,8 @@ relation Flow(
     logical_datapath: uuid,
     stage:            Intern<Stage>,
     priority:         integer,
-    __match:          string,
-    actions:          string,
+    __match:          istring,
+    actions:          istring,
     io_port:          Option<string>,
     controller_meter: Option<string>,
     stage_hint:       bit<32>
@@ -1665,8 +1665,8 @@ relation AggregatedFlow (
     logical_datapaths: Set<uuid>,
     stage:             Intern<Stage>,
     priority:          integer,
-    __match:           string,
-    actions:           string,
+    __match:           istring,
+    actions:           istring,
     tags:              Map<string,string>,
     controller_meter:  Option<string>,
     external_ids:      Map<string,string>
@@ -1720,8 +1720,8 @@ for (f in AggregatedFlow()) {
             .table_id         = f.stage.table_id as integer,
             .priority         = f.priority,
             .controller_meter = f.controller_meter,
-            .__match          = f.__match,
-            .actions          = f.actions,
+            .__match          = f.__match.ival(),
+            .actions          = f.actions.ival(),
             .tags             = f.tags,
             .external_ids     = external_ids)
     } else {
@@ -1734,8 +1734,8 @@ for (f in AggregatedFlow()) {
                 .table_id         = f.stage.table_id as integer,
                 .priority         = f.priority,
                 .controller_meter = f.controller_meter,
-                .__match          = f.__match,
-                .actions          = f.actions,
+                .__match          = f.__match.ival(),
+                .actions          = f.actions.ival(),
                 .tags             = f.tags,
                 .external_ids     = external_ids);
             sb::Out_Logical_DP_Group(._uuid = group_uuid, .datapaths = f.logical_datapaths)
@@ -1757,8 +1757,8 @@ Flow(.logical_datapath = sw._uuid,
     var fg_uuid = FlatMap(forwarding_groups),
     fg in nb::Forwarding_Group(._uuid = fg_uuid),
     not fg.child_port.is_empty(),
-    var __match = "arp.tpa == ${fg.vip} && arp.op == 1",
-    var actions = "eth.dst = eth.src; "
+    var __match = i"arp.tpa == ${fg.vip} && arp.op == 1",
+    var actions = i"eth.dst = eth.src; "
                   "eth.src = ${fg.vmac}; "
                   "arp.op = 2; /* ARP reply */ "
                   "arp.tha = arp.sha; "
@@ -1779,8 +1779,8 @@ function escape_child_ports(child_port: Set<string>): string {
 Flow(.logical_datapath = sw._uuid,
      .stage            = s_SWITCH_IN_L2_LKUP(),
      .priority         = 50,
-     .__match          = __match,
-     .actions          = actions,
+     .__match          = __match.intern(),
+     .actions          = actions.intern(),
      .stage_hint       = 0,
      .io_port          = None,
      .controller_meter = None) :-
@@ -1802,8 +1802,8 @@ for (sw in &Switch()) {
         Flow(.logical_datapath = sw._uuid,
              .stage            = s_SWITCH_IN_PORT_SEC_L2(),
              .priority         = 100,
-             .__match          = "vlan.present",
-             .actions          = "drop;",
+             .__match          = i"vlan.present",
+             .actions          = i"drop;",
              .stage_hint       = 0 /*TODO: check*/,
              .io_port          = None,
              .controller_meter = None)
@@ -1813,8 +1813,8 @@ for (sw in &Switch()) {
     Flow(.logical_datapath = sw._uuid,
          .stage            = s_SWITCH_IN_PORT_SEC_L2(),
          .priority         = 100,
-         .__match          = "eth.src[40]",
-         .actions          = "drop;",
+         .__match          = i"eth.src[40]",
+         .actions          = i"drop;",
          .stage_hint       = 0 /*TODO: check*/,
          .io_port          = None,
          .controller_meter = None)
@@ -1875,16 +1875,16 @@ for (&Switch(._uuid =ls_uuid)) {
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_IN_PRE_ACL(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_OUT_PRE_ACL(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
@@ -1892,31 +1892,31 @@ for (&Switch(._uuid =ls_uuid)) {
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_IN_PRE_ACL(),
          .priority         = 110,
-         .__match          = "eth.dst == $svc_monitor_mac",
-         .actions          = "next;",
+         .__match          = i"eth.dst == $svc_monitor_mac",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_OUT_PRE_ACL(),
          .priority         = 110,
-         .__match          = "eth.src == $svc_monitor_mac",
-         .actions          = "next;",
+         .__match          = i"eth.src == $svc_monitor_mac",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None)
 }
 
 /* stateless filters always take precedence over stateful ACLs. */
-for (&SwitchACL(.sw = sw@&Switch{._uuid = ls_uuid}, .acl = &acl, .has_fair_meter = fair_meter)) {
+for (&SwitchACL(.sw = sw@&Switch{._uuid = ls_uuid}, .acl = acl, .has_fair_meter = fair_meter)) {
     if (sw.has_stateful_acl) {
         if (acl.action == "allow-stateless") {
             if (acl.direction == "from-lport") {
                 Flow(.logical_datapath = ls_uuid,
                      .stage            = s_SWITCH_IN_PRE_ACL(),
                      .priority         = acl.priority + oVN_ACL_PRI_OFFSET(),
-                     .__match          = acl.__match,
-                     .actions          = "next;",
+                     .__match          = acl.__match.intern(),
+                     .actions          = i"next;",
                      .stage_hint       = stage_hint(acl._uuid),
                      .io_port          = None,
                      .controller_meter = None)
@@ -1924,8 +1924,8 @@ for (&SwitchACL(.sw = sw@&Switch{._uuid = ls_uuid}, .acl = &acl, .has_fair_meter
                 Flow(.logical_datapath = ls_uuid,
                      .stage            = s_SWITCH_OUT_PRE_ACL(),
                      .priority         = acl.priority + oVN_ACL_PRI_OFFSET(),
-                     .__match          = acl.__match,
-                     .actions          = "next;",
+                     .__match          = acl.__match.intern(),
+                     .actions          = i"next;",
                      .stage_hint       = stage_hint(acl._uuid),
                      .io_port          = None,
                      .controller_meter = None)
@@ -1956,16 +1956,16 @@ for (&SwitchPort(.lsp = lsp@&nb::Logical_Switch_Port{.__type = "router"},
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_IN_PRE_ACL(),
          .priority         = 110,
-         .__match          = "ip && inport == ${lsp_name}",
-         .actions          = "next;",
+         .__match          = i"ip && inport == ${lsp_name}",
+         .actions          = i"next;",
          .stage_hint       = stage_hint(lsp._uuid),
          .io_port          = Some{lsp.name},
          .controller_meter = None);
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_OUT_PRE_ACL(),
          .priority         = 110,
-         .__match          = "ip && outport == ${lsp_name}",
-         .actions          = "next;",
+         .__match          = i"ip && outport == ${lsp_name}",
+         .actions          = i"next;",
          .stage_hint       = stage_hint(lsp._uuid),
          .io_port          = Some{lsp.name},
          .controller_meter = None)
@@ -1977,16 +1977,16 @@ for (&SwitchPort(.lsp = lsp@&nb::Logical_Switch_Port{.__type = "localnet"},
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_IN_PRE_ACL(),
          .priority         = 110,
-         .__match          = "ip && inport == ${lsp_name}",
-         .actions          = "next;",
+         .__match          = i"ip && inport == ${lsp_name}",
+         .actions          = i"next;",
          .stage_hint       = stage_hint(lsp._uuid),
          .io_port          = Some{lsp.name},
          .controller_meter = None);
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_OUT_PRE_ACL(),
          .priority         = 110,
-         .__match          = "ip && outport == ${lsp_name}",
-         .actions          = "next;",
+         .__match          = i"ip && outport == ${lsp_name}",
+         .actions          = i"next;",
          .stage_hint       = stage_hint(lsp._uuid),
          .io_port          = Some{lsp.name},
          .controller_meter = None)
@@ -2000,18 +2000,18 @@ for (&Switch(._uuid = ls_uuid, .has_stateful_acl = true)) {
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_IN_PRE_ACL(),
          .priority         = 110,
-         .__match          = "nd || nd_rs || nd_ra || mldv1 || mldv2 || "
+         .__match          = i"nd || nd_rs || nd_ra || mldv1 || mldv2 || "
                              "(udp && udp.src == 546 && udp.dst == 547)",
-         .actions          = "next;",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_OUT_PRE_ACL(),
          .priority         = 110,
-         .__match          = "nd || nd_rs || nd_ra || mldv1 || mldv2 || "
+         .__match          = i"nd || nd_rs || nd_ra || mldv1 || mldv2 || "
                              "(udp && udp.src == 546 && udp.dst == 547)",
-         .actions          = "next;",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
@@ -2027,16 +2027,16 @@ for (&Switch(._uuid = ls_uuid, .has_stateful_acl = true)) {
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_IN_PRE_ACL(),
          .priority         = 100,
-         .__match          = "ip",
-         .actions          = "${rEGBIT_CONNTRACK_DEFRAG()} = 1; next;",
+         .__match          = i"ip",
+         .actions          = i"${rEGBIT_CONNTRACK_DEFRAG()} = 1; next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_OUT_PRE_ACL(),
          .priority         = 100,
-         .__match          = "ip",
-         .actions          = "${rEGBIT_CONNTRACK_DEFRAG()} = 1; next;",
+         .__match          = i"ip",
+         .actions          = i"${rEGBIT_CONNTRACK_DEFRAG()} = 1; next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None)
@@ -2045,12 +2045,12 @@ for (&Switch(._uuid = ls_uuid, .has_stateful_acl = true)) {
 /* Pre-LB */
 for (&Switch(._uuid = ls_uuid)) {
     /* Do not send ND packets to conntrack */
-    var __match = "nd || nd_rs || nd_ra || mldv1 || mldv2" in {
+    var __match = i"nd || nd_rs || nd_ra || mldv1 || mldv2" in {
         Flow(.logical_datapath = ls_uuid,
              .stage            = s_SWITCH_IN_PRE_LB(),
              .priority         = 110,
              .__match          = __match,
-             .actions          = "next;",
+             .actions          = i"next;",
              .stage_hint       = 0,
              .io_port          = None,
              .controller_meter = None);
@@ -2058,7 +2058,7 @@ for (&Switch(._uuid = ls_uuid)) {
              .stage            = s_SWITCH_OUT_PRE_LB(),
              .priority         = 110,
              .__match          = __match,
-             .actions          = "next;",
+             .actions          = i"next;",
              .stage_hint       = 0,
              .io_port          = None,
              .controller_meter = None)
@@ -2068,16 +2068,16 @@ for (&Switch(._uuid = ls_uuid)) {
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_IN_PRE_LB(),
          .priority         = 110,
-         .__match          = "eth.dst == $svc_monitor_mac",
-         .actions          = "next;",
+         .__match          = i"eth.dst == $svc_monitor_mac",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_OUT_PRE_LB(),
          .priority         = 110,
-         .__match          = "eth.src == $svc_monitor_mac",
-         .actions          = "next;",
+         .__match          = i"eth.src == $svc_monitor_mac",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
@@ -2086,16 +2086,16 @@ for (&Switch(._uuid = ls_uuid)) {
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_IN_PRE_LB(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_OUT_PRE_LB(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None)
@@ -2106,23 +2106,23 @@ if (lsp.__type == "router" or lsp.__type == "localnet") {
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_IN_PRE_LB(),
          .priority         = 110,
-         .__match          = "ip && inport == ${lsp_name}",
-         .actions          = "next;",
+         .__match          = i"ip && inport == ${lsp_name}",
+         .actions          = i"next;",
          .stage_hint       = stage_hint(lsp._uuid),
          .io_port          = Some{lsp.name},
          .controller_meter = None);
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_OUT_PRE_LB(),
          .priority         = 110,
-         .__match          = "ip && outport == ${lsp_name}",
-         .actions          = "next;",
+         .__match          = i"ip && outport == ${lsp_name}",
+         .actions          = i"next;",
          .stage_hint       = stage_hint(lsp._uuid),
          .io_port          = Some{lsp.name},
          .controller_meter = None)
 }
 
 /* Empty LoadBalancer Controller event */
-function build_empty_lb_event_flow(key: string, lb: Intern<nb::Load_Balancer>): Option<(string, string)> {
+function build_empty_lb_event_flow(key: string, lb: Intern<nb::Load_Balancer>): Option<(istring, istring)> {
     (var ip, var port) = match (ip_address_and_port_from_lb_key(key)) {
         Some{(ip, port)} -> (ip, port),
         _ -> return None
@@ -2143,13 +2143,13 @@ function build_empty_lb_event_flow(key: string, lb: Intern<nb::Load_Balancer>):
         __match.push("${protocol}.dst == ${port}");
     };
 
-    var action = "trigger_event("
+    var action = i"trigger_event("
                  "event = \"empty_lb_backends\", "
                  "vip = \"${vip}\", "
                  "protocol = \"${protocol}\", "
                  "load_balancer = \"${uuid2str(lb._uuid)}\");";
 
-    Some{(__match.join(" && "), action)}
+    Some{(__match.join(" && ").intern(), action)}
 }
 
 /* Contains the load balancers for which an event should be sent each time it
@@ -2217,16 +2217,16 @@ for (sw in &Switch(.has_lb_vip = true)) {
     Flow(.logical_datapath = sw._uuid,
          .stage            = s_SWITCH_IN_PRE_LB(),
          .priority         = 100,
-         .__match          = "ip",
-         .actions          = "${rEGBIT_CONNTRACK_NAT()} = 1; next;",
+         .__match          = i"ip",
+         .actions          = i"${rEGBIT_CONNTRACK_NAT()} = 1; next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
     Flow(.logical_datapath = sw._uuid,
          .stage            = s_SWITCH_OUT_PRE_LB(),
          .priority         = 100,
-         .__match          = "ip",
-         .actions          = "${rEGBIT_CONNTRACK_NAT()} = 1; next;",
+         .__match          = i"ip",
+         .actions          = i"${rEGBIT_CONNTRACK_NAT()} = 1; next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None)
@@ -2243,16 +2243,16 @@ for (&Switch(._uuid = ls_uuid)) {
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_IN_PRE_STATEFUL(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_OUT_PRE_STATEFUL(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
@@ -2271,8 +2271,8 @@ for (&Switch(._uuid = ls_uuid)) {
         Flow(.logical_datapath = ls_uuid,
              .stage            = s_SWITCH_IN_PRE_STATEFUL(),
              .priority         = 120,
-             .__match          = "${rEGBIT_CONNTRACK_NAT()} == 1 && ip4 && ${protocol}",
-             .actions          = "${rEG_ORIG_DIP_IPV4()} = ip4.dst; "
+             .__match          = i"${rEGBIT_CONNTRACK_NAT()} == 1 && ip4 && ${protocol}",
+             .actions          = i"${rEG_ORIG_DIP_IPV4()} = ip4.dst; "
                                  "${rEG_ORIG_TP_DPORT()} = ${protocol}.dst; ct_lb;",
              .stage_hint       = 0,
              .io_port          = None,
@@ -2280,8 +2280,8 @@ for (&Switch(._uuid = ls_uuid)) {
         Flow(.logical_datapath = ls_uuid,
              .stage            = s_SWITCH_IN_PRE_STATEFUL(),
              .priority         = 120,
-             .__match          = "${rEGBIT_CONNTRACK_NAT()} == 1 && ip6 && ${protocol}",
-             .actions          = "${rEG_ORIG_DIP_IPV6()} = ip6.dst; "
+             .__match          = i"${rEGBIT_CONNTRACK_NAT()} == 1 && ip6 && ${protocol}",
+             .actions          = i"${rEG_ORIG_DIP_IPV6()} = ip6.dst; "
                                  "${rEG_ORIG_TP_DPORT()} = ${protocol}.dst; ct_lb;",
              .stage_hint       = 0,
              .io_port          = None,
@@ -2291,8 +2291,8 @@ for (&Switch(._uuid = ls_uuid)) {
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_IN_PRE_STATEFUL(),
          .priority         = 110,
-         .__match          = "${rEGBIT_CONNTRACK_NAT()} == 1",
-         .actions          = "ct_lb;",
+         .__match          = i"${rEGBIT_CONNTRACK_NAT()} == 1",
+         .actions          = i"ct_lb;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
@@ -2300,8 +2300,8 @@ for (&Switch(._uuid = ls_uuid)) {
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_OUT_PRE_STATEFUL(),
          .priority         = 110,
-         .__match          = "${rEGBIT_CONNTRACK_NAT()} == 1",
-         .actions          = "ct_lb;",
+         .__match          = i"${rEGBIT_CONNTRACK_NAT()} == 1",
+         .actions          = i"ct_lb;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
@@ -2311,16 +2311,16 @@ for (&Switch(._uuid = ls_uuid)) {
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_IN_PRE_STATEFUL(),
          .priority         = 100,
-         .__match          = "${rEGBIT_CONNTRACK_DEFRAG()} == 1",
-         .actions          = "ct_next;",
+         .__match          = i"${rEGBIT_CONNTRACK_DEFRAG()} == 1",
+         .actions          = i"ct_next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_OUT_PRE_STATEFUL(),
          .priority         = 100,
-         .__match          = "${rEGBIT_CONNTRACK_DEFRAG()} == 1",
-         .actions          = "ct_next;",
+         .__match          = i"${rEGBIT_CONNTRACK_DEFRAG()} == 1",
+         .actions          = i"ct_next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None)
@@ -2428,8 +2428,8 @@ for (Reject(lsuuid, pipeline, stage, acl, fair_meter, controller_meter,
     Flow(.logical_datapath = lsuuid,
          .stage            = stage,
          .priority         = acl.priority + oVN_ACL_PRI_OFFSET(),
-         .__match          = __match,
-         .actions          = actions,
+         .__match          = __match.intern(),
+         .actions          = actions.intern(),
          .io_port          = None,
          .controller_meter = controller_meter,
          .stage_hint       = stage_hint(acl._uuid))
@@ -2457,16 +2457,16 @@ for (UseCtInvMatch[use_ct_inv_match]) {
             Flow(.logical_datapath = ls_uuid,
                 .stage            = s_SWITCH_IN_ACL(),
                 .priority         = priority,
-                .__match          = "1",
-                .actions          = "next;",
+                .__match          = i"1",
+                .actions          = i"next;",
                 .stage_hint       = 0,
                 .io_port          = None,
                 .controller_meter = None);
             Flow(.logical_datapath = ls_uuid,
                 .stage            = s_SWITCH_OUT_ACL(),
                 .priority         = priority,
-                .__match          = "1",
-                .actions          = "next;",
+                .__match          = i"1",
+                .actions          = i"next;",
                 .stage_hint       = 0,
                 .io_port          = None,
                 .controller_meter = None)
@@ -2497,16 +2497,16 @@ for (UseCtInvMatch[use_ct_inv_match]) {
             Flow(.logical_datapath = ls_uuid,
                  .stage            = s_SWITCH_IN_ACL(),
                  .priority         = 1,
-                 .__match          = "ip && (!ct.est || (ct.est && ct_label.blocked == 1))",
-                 .actions          = "${rEGBIT_CONNTRACK_COMMIT()} = 1; next;",
+                 .__match          = i"ip && (!ct.est || (ct.est && ct_label.blocked == 1))",
+                 .actions          = i"${rEGBIT_CONNTRACK_COMMIT()} = 1; next;",
                  .stage_hint       = 0,
                  .io_port          = None,
                  .controller_meter = None);
             Flow(.logical_datapath = ls_uuid,
                  .stage            = s_SWITCH_OUT_ACL(),
                  .priority         = 1,
-                 .__match          = "ip && (!ct.est || (ct.est && ct_label.blocked == 1))",
-                 .actions          = "${rEGBIT_CONNTRACK_COMMIT()} = 1; next;",
+                 .__match          = i"ip && (!ct.est || (ct.est && ct_label.blocked == 1))",
+                 .actions          = i"${rEGBIT_CONNTRACK_COMMIT()} = 1; next;",
                  .stage_hint       = 0,
                  .io_port          = None,
                  .controller_meter = None);
@@ -2518,22 +2518,24 @@ for (UseCtInvMatch[use_ct_inv_match]) {
              * for deletion (bit 0 of ct_label is set).
              *
              * This is enforced at a higher priority than ACLs can be defined. */
-            Flow(.logical_datapath = ls_uuid,
-                 .stage            = s_SWITCH_IN_ACL(),
-                 .priority         = 65532,
-                 .__match          = ct_inv_or ++ "(ct.est && ct.rpl && ct_label.blocked == 1)",
-                 .actions          = "drop;",
-                 .stage_hint       = 0,
-                 .io_port          = None,
-                 .controller_meter = None);
-            Flow(.logical_datapath = ls_uuid,
-                 .stage            = s_SWITCH_OUT_ACL(),
-                 .priority         = 65532,
-                 .__match          = ct_inv_or ++ "(ct.est && ct.rpl && ct_label.blocked == 1)",
-                 .actions          = "drop;",
-                 .stage_hint       = 0,
-                 .io_port          = None,
-                 .controller_meter = None);
+            var __match = (ct_inv_or ++ "(ct.est && ct.rpl && ct_label.blocked == 1)").intern() in {
+                Flow(.logical_datapath = ls_uuid,
+                     .stage            = s_SWITCH_IN_ACL(),
+                     .priority         = 65532,
+                     .__match          = __match,
+                     .actions          = i"drop;",
+                     .stage_hint       = 0,
+                     .io_port          = None,
+                     .controller_meter = None);
+                Flow(.logical_datapath = ls_uuid,
+                     .stage            = s_SWITCH_OUT_ACL(),
+                     .priority         = 65532,
+                     .__match          = __match,
+                     .actions          = i"drop;",
+                     .stage_hint       = 0,
+                     .io_port          = None,
+                     .controller_meter = None)
+            };
 
             /* Ingress and Egress ACL Table (Priority 65532).
              *
@@ -2544,24 +2546,25 @@ for (UseCtInvMatch[use_ct_inv_match]) {
              * direction to hit the currently defined policy from ACLs.
              *
              * This is enforced at a higher priority than ACLs can be defined. */
-            Flow(.logical_datapath = ls_uuid,
-                 .stage            = s_SWITCH_IN_ACL(),
-                 .priority         = 65532,
-                 .__match          = "ct.est && !ct.rel && !ct.new " ++ and_not_ct_inv ++
-                                     "&& ct.rpl && ct_label.blocked == 0",
-                 .actions          = "next;",
-                 .stage_hint       = 0,
-                 .io_port          = None,
-                 .controller_meter = None);
-            Flow(.logical_datapath = ls_uuid,
-                 .stage            = s_SWITCH_OUT_ACL(),
-                 .priority         = 65532,
-                 .__match          = "ct.est && !ct.rel && !ct.new " ++ and_not_ct_inv ++
-                                     "&& ct.rpl && ct_label.blocked == 0",
-                 .actions          = "next;",
-                 .stage_hint       = 0,
-                 .io_port          = None,
-                 .controller_meter = None);
+            var __match = ("ct.est && !ct.rel && !ct.new " ++ and_not_ct_inv ++
+                           "&& ct.rpl && ct_label.blocked == 0").intern() in {
+                Flow(.logical_datapath = ls_uuid,
+                     .stage            = s_SWITCH_IN_ACL(),
+                     .priority         = 65532,
+                     .__match          = __match,
+                     .actions          = i"next;",
+                     .stage_hint       = 0,
+                     .io_port          = None,
+                     .controller_meter = None);
+                Flow(.logical_datapath = ls_uuid,
+                     .stage            = s_SWITCH_OUT_ACL(),
+                     .priority         = 65532,
+                     .__match          = __match,
+                     .actions          = i"next;",
+                     .stage_hint       = 0,
+                     .io_port          = None,
+                     .controller_meter = None)
+            };
 
             /* Ingress and Egress ACL Table (Priority 65532).
              *
@@ -2574,24 +2577,25 @@ for (UseCtInvMatch[use_ct_inv_match]) {
              * a dynamically negotiated FTP data channel), but will allow
              * related traffic such as an ICMP Port Unreachable through
              * that's generated from a non-listening UDP port.  */
-            Flow(.logical_datapath = ls_uuid,
-                 .stage            = s_SWITCH_IN_ACL(),
-                 .priority         = 65532,
-                 .__match          = "!ct.est && ct.rel && !ct.new " ++ and_not_ct_inv ++
-                                     "&& ct_label.blocked == 0",
-                 .actions          = "next;",
-                 .stage_hint       = 0,
-                 .io_port          = None,
-                 .controller_meter = None);
-            Flow(.logical_datapath = ls_uuid,
-                 .stage            = s_SWITCH_OUT_ACL(),
-                 .priority         = 65532,
-                 .__match          = "!ct.est && ct.rel && !ct.new " ++ and_not_ct_inv ++
-                                     "&& ct_label.blocked == 0",
-                 .actions          = "next;",
-                 .stage_hint       = 0,
-                 .io_port          = None,
-                 .controller_meter = None);
+            var __match = ("!ct.est && ct.rel && !ct.new " ++ and_not_ct_inv ++
+                           "&& ct_label.blocked == 0").intern() in {
+                Flow(.logical_datapath = ls_uuid,
+                     .stage            = s_SWITCH_IN_ACL(),
+                     .priority         = 65532,
+                     .__match          = __match,
+                     .actions          = i"next;",
+                     .stage_hint       = 0,
+                     .io_port          = None,
+                     .controller_meter = None);
+                Flow(.logical_datapath = ls_uuid,
+                     .stage            = s_SWITCH_OUT_ACL(),
+                     .priority         = 65532,
+                     .__match          = __match,
+                     .actions          = i"next;",
+                     .stage_hint       = 0,
+                     .io_port          = None,
+                     .controller_meter = None)
+            };
 
             /* Ingress and Egress ACL Table (Priority 65532).
              *
@@ -2599,16 +2603,16 @@ for (UseCtInvMatch[use_ct_inv_match]) {
             Flow(.logical_datapath = ls_uuid,
                  .stage            = s_SWITCH_IN_ACL(),
                  .priority         = 65532,
-                 .__match          = "nd || nd_ra || nd_rs || mldv1 || mldv2",
-                 .actions          = "next;",
+                 .__match          = i"nd || nd_ra || nd_rs || mldv1 || mldv2",
+                 .actions          = i"next;",
                  .stage_hint       = 0,
                  .io_port          = None,
                  .controller_meter = None);
             Flow(.logical_datapath = ls_uuid,
                  .stage            = s_SWITCH_OUT_ACL(),
                  .priority         = 65532,
-                 .__match          = "nd || nd_ra || nd_rs || mldv1 || mldv2",
-                 .actions          = "next;",
+                 .__match          = i"nd || nd_ra || nd_rs || mldv1 || mldv2",
+                 .actions          = i"next;",
                  .stage_hint       = 0,
                  .io_port          = None,
                  .controller_meter = None)
@@ -2621,8 +2625,8 @@ for (UseCtInvMatch[use_ct_inv_match]) {
             Flow(.logical_datapath = ls_uuid,
                  .stage            = s_SWITCH_OUT_ACL(),
                  .priority         = 34000,
-                 .__match          = "udp.src == 53",
-                 .actions          = if has_stateful "ct_commit; next;" else "next;",
+                 .__match          = i"udp.src == 53",
+                 .actions          = if has_stateful i"ct_commit; next;" else i"next;",
                  .stage_hint       = 0,
                  .io_port          = None,
                  .controller_meter = None)
@@ -2634,16 +2638,16 @@ for (UseCtInvMatch[use_ct_inv_match]) {
             Flow(.logical_datapath = ls_uuid,
                  .stage            = s_SWITCH_IN_ACL(),
                  .priority         = 34000,
-                 .__match          = "eth.dst == $svc_monitor_mac",
-                 .actions          = "next;",
+                 .__match          = i"eth.dst == $svc_monitor_mac",
+                 .actions          = i"next;",
                  .stage_hint       = 0,
                  .io_port          = None,
                  .controller_meter = None);
             Flow(.logical_datapath = ls_uuid,
                  .stage            = s_SWITCH_OUT_ACL(),
                  .priority         = 34000,
-                 .__match          = "eth.src == $svc_monitor_mac",
-                 .actions          = "next;",
+                 .__match          = i"eth.src == $svc_monitor_mac",
+                 .actions          = i"next;",
                  .stage_hint       = 0,
                  .io_port          = None,
                  .controller_meter = None)
@@ -2670,7 +2674,7 @@ for (sw in &Switch(._uuid = ls_uuid)) {
     for (AclHintStages[stage]) {
         /* In any case, advance to the next stage. */
         var priority = if (not sw.has_acls and not sw.has_lb_vip) { 65535 } else { 0 } in
-        Flow(ls_uuid, stage, priority, "1", "next;", None, None, 0)
+        Flow(ls_uuid, stage, priority, i"1", i"next;", None, None, 0)
     };
 
     for (AclHintStages[stage])
@@ -2679,8 +2683,8 @@ for (sw in &Switch(._uuid = ls_uuid)) {
          * or drop ACLs. For allow ACLs, the connection must also be committed
          * to conntrack so we set REGBIT_ACL_HINT_ALLOW_NEW.
          */
-        Flow(ls_uuid, stage, 7, "ct.new && !ct.est",
-             "${rEGBIT_ACL_HINT_ALLOW_NEW()} = 1; "
+        Flow(ls_uuid, stage, 7, i"ct.new && !ct.est",
+             i"${rEGBIT_ACL_HINT_ALLOW_NEW()} = 1; "
              "${rEGBIT_ACL_HINT_DROP()} = 1; "
              "next;", None, None, 0);
 
@@ -2692,14 +2696,14 @@ for (sw in &Switch(._uuid = ls_uuid)) {
          *   REGBIT_ACL_HINT_ALLOW_NEW.
          * - drop ACLs.
          */
-        Flow(ls_uuid, stage, 6, "!ct.new && ct.est && !ct.rpl && ct_label.blocked == 1",
-             "${rEGBIT_ACL_HINT_ALLOW_NEW()} = 1; "
+        Flow(ls_uuid, stage, 6, i"!ct.new && ct.est && !ct.rpl && ct_label.blocked == 1",
+             i"${rEGBIT_ACL_HINT_ALLOW_NEW()} = 1; "
              "${rEGBIT_ACL_HINT_DROP()} = 1; "
              "next;", None, None, 0);
 
         /* Not tracked traffic can either be allowed or dropped. */
-        Flow(ls_uuid, stage, 5, "!ct.trk",
-             "${rEGBIT_ACL_HINT_ALLOW()} = 1; "
+        Flow(ls_uuid, stage, 5, i"!ct.trk",
+             i"${rEGBIT_ACL_HINT_ALLOW()} = 1; "
              "${rEGBIT_ACL_HINT_DROP()} = 1; "
              "next;", None, None, 0);
 
@@ -2711,27 +2715,27 @@ for (sw in &Switch(._uuid = ls_uuid)) {
          *   connection must be committed with ct_label.blocked set so we set
          *   REGBIT_ACL_HINT_BLOCK.
          */
-        Flow(ls_uuid, stage, 4, "!ct.new && ct.est && !ct.rpl && ct_label.blocked == 0",
-             "${rEGBIT_ACL_HINT_ALLOW()} = 1; "
+        Flow(ls_uuid, stage, 4, i"!ct.new && ct.est && !ct.rpl && ct_label.blocked == 0",
+             i"${rEGBIT_ACL_HINT_ALLOW()} = 1; "
              "${rEGBIT_ACL_HINT_BLOCK()} = 1; "
              "next;", None, None, 0);
 
         /* Not established or established and already blocked connections may
          * hit drop ACLs.
          */
-        Flow(ls_uuid, stage, 3, "!ct.est",
-             "${rEGBIT_ACL_HINT_DROP()} = 1; "
+        Flow(ls_uuid, stage, 3, i"!ct.est",
+             i"${rEGBIT_ACL_HINT_DROP()} = 1; "
              "next;", None, None, 0);
-        Flow(ls_uuid, stage, 2, "ct.est && ct_label.blocked == 1",
-             "${rEGBIT_ACL_HINT_DROP()} = 1; "
+        Flow(ls_uuid, stage, 2, i"ct.est && ct_label.blocked == 1",
+             i"${rEGBIT_ACL_HINT_DROP()} = 1; "
              "next;", None, None, 0);
 
         /* Established connections that were previously allowed might hit
          * drop ACLs in which case the connection must be committed with
          * ct_label.blocked set.
          */
-        Flow(ls_uuid, stage, 1, "ct.est && ct_label.blocked == 0",
-             "${rEGBIT_ACL_HINT_BLOCK()} = 1; "
+        Flow(ls_uuid, stage, 1, i"ct.est && ct_label.blocked == 0",
+             i"${rEGBIT_ACL_HINT_BLOCK()} = 1; "
              "next;", None, None, 0)
     }
 }
@@ -2745,6 +2749,7 @@ for (&SwitchACL(.sw = sw, .acl = acl, .has_fair_meter = fair_meter)) {
     var pipeline = if ingress Ingress else Egress in
     var stage_hint = stage_hint(acl._uuid) in
     var acl_log = build_acl_log(acl, fair_meter) in
+    var acl_match = acl.__match.intern() in
     if (acl.action == "allow" or acl.action == "allow-related") {
         /* If there are any stateful flows, we must even commit "allow"
          * actions.  This is because, while the initiater's
@@ -2755,8 +2760,8 @@ for (&SwitchACL(.sw = sw, .acl = acl, .has_fair_meter = fair_meter)) {
             Flow(.logical_datapath = sw._uuid,
                  .stage            = stage,
                  .priority         = acl.priority + oVN_ACL_PRI_OFFSET(),
-                 .__match          = acl.__match,
-                 .actions          = "${acl_log}next;",
+                 .__match          = acl.__match.intern(),
+                 .actions          = i"${acl_log}next;",
                  .stage_hint       = stage_hint,
                  .io_port          = None,
                  .controller_meter = None)
@@ -2776,8 +2781,8 @@ for (&SwitchACL(.sw = sw, .acl = acl, .has_fair_meter = fair_meter)) {
             Flow(.logical_datapath = sw._uuid,
                  .stage            = stage,
                  .priority         = acl.priority + oVN_ACL_PRI_OFFSET(),
-                 .__match          = "${rEGBIT_ACL_HINT_ALLOW_NEW()} == 1 && (${acl.__match})",
-                 .actions          = "${rEGBIT_CONNTRACK_COMMIT()} = 1; ${acl_log}next;",
+                 .__match          = i"${rEGBIT_ACL_HINT_ALLOW_NEW()} == 1 && (${acl.__match})",
+                 .actions          = i"${rEGBIT_CONNTRACK_COMMIT()} = 1; ${acl_log}next;",
                  .stage_hint       = stage_hint,
                  .io_port          = None,
                  .controller_meter = None);
@@ -2791,8 +2796,8 @@ for (&SwitchACL(.sw = sw, .acl = acl, .has_fair_meter = fair_meter)) {
             Flow(.logical_datapath = sw._uuid,
                  .stage            = stage,
                  .priority         = acl.priority + oVN_ACL_PRI_OFFSET(),
-                 .__match          = "${rEGBIT_ACL_HINT_ALLOW()} == 1 && (${acl.__match})",
-                 .actions          = "${acl_log}next;",
+                 .__match          = i"${rEGBIT_ACL_HINT_ALLOW()} == 1 && (${acl.__match})",
+                 .actions          = i"${acl_log}next;",
                  .stage_hint       = stage_hint,
                  .io_port          = None,
                  .controller_meter = None)
@@ -2801,8 +2806,8 @@ for (&SwitchACL(.sw = sw, .acl = acl, .has_fair_meter = fair_meter)) {
         Flow(.logical_datapath = sw._uuid,
              .stage            = stage,
              .priority         = acl.priority + oVN_ACL_PRI_OFFSET(),
-             .__match          = acl.__match,
-             .actions          = "${acl_log}next;",
+             .__match          = acl.__match.intern(),
+             .actions          = i"${acl_log}next;",
              .stage_hint       = stage_hint,
              .io_port          = None,
              .controller_meter = None)
@@ -2822,8 +2827,8 @@ for (&SwitchACL(.sw = sw, .acl = acl, .has_fair_meter = fair_meter)) {
                 Flow(.logical_datapath = sw._uuid,
                      .stage            = stage,
                      .priority         = acl.priority + oVN_ACL_PRI_OFFSET(),
-                     .__match          = __match ++ " && (${acl.__match})",
-                     .actions          = "${acl_log}/* drop */",
+                     .__match          = (__match ++ " && (${acl.__match})").intern(),
+                     .actions          = i"${acl_log}/* drop */",
                      .stage_hint       = stage_hint,
                      .io_port          = None,
                      .controller_meter = None)
@@ -2847,8 +2852,8 @@ for (&SwitchACL(.sw = sw, .acl = acl, .has_fair_meter = fair_meter)) {
                 Flow(.logical_datapath = sw._uuid,
                      .stage            = stage,
                      .priority         = acl.priority + oVN_ACL_PRI_OFFSET(),
-                     .__match          = __match ++ " && (${acl.__match})",
-                     .actions          = "${actions}${acl_log}/* drop */",
+                     .__match          = (__match ++ " && (${acl.__match})").intern(),
+                     .actions          = i"${actions}${acl_log}/* drop */",
                      .stage_hint       = stage_hint,
                      .io_port          = None,
                      .controller_meter = None)
@@ -2863,8 +2868,8 @@ for (&SwitchACL(.sw = sw, .acl = acl, .has_fair_meter = fair_meter)) {
                 Flow(.logical_datapath = sw._uuid,
                      .stage            = stage,
                      .priority         = acl.priority + oVN_ACL_PRI_OFFSET(),
-                     .__match          = acl.__match,
-                     .actions          = "${acl_log}/* drop */",
+                     .__match          = acl.__match.intern(),
+                     .actions          = i"${acl_log}/* drop */",
                      .stage_hint       = stage_hint,
                      .io_port          = None,
                      .controller_meter = None)
@@ -2885,11 +2890,11 @@ for (SwitchPortDHCPv4Options(.port = &SwitchPort{.lsp = lsp, .sw = sw},
     Flow(.logical_datapath = sw._uuid,
          .stage            = s_SWITCH_OUT_ACL(),
          .priority         = 34000,
-         .__match          = "outport == ${json_string_escape(lsp.name)} "
+         .__match          = i"outport == ${json_string_escape(lsp.name)} "
                              "&& eth.src == ${server_mac} "
                              "&& ip4.src == ${server_id} && udp && udp.src == 67 "
                              "&& udp.dst == 68",
-         .actions          = if (has_stateful) "ct_commit; next;" else "next;",
+         .actions          = if (has_stateful) i"ct_commit; next;" else i"next;",
          .stage_hint       = stage_hint(dhcpv4_options._uuid),
          .io_port          = Some{lsp.name},
          .controller_meter = None)
@@ -2907,11 +2912,11 @@ for (SwitchPortDHCPv6Options(.port = &SwitchPort{.lsp = lsp, .sw = sw},
     Flow(.logical_datapath = sw._uuid,
          .stage            = s_SWITCH_OUT_ACL(),
          .priority         = 34000,
-         .__match          = "outport == ${json_string_escape(lsp.name)} "
+         .__match          = i"outport == ${json_string_escape(lsp.name)} "
                              "&& eth.src == ${server_mac} "
                              "&& ip6.src == ${server_ip} && udp && udp.src == 547 "
                              "&& udp.dst == 546",
-         .actions          = if (has_stateful) "ct_commit; next;" else "next;",
+         .actions          = if (has_stateful) i"ct_commit; next;" else i"next;",
          .stage_hint       = stage_hint(dhcpv6_options._uuid),
          .io_port          = Some{lsp.name},
          .controller_meter = None)
@@ -2929,32 +2934,32 @@ for (&Switch(._uuid = ls_uuid)) {
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_IN_QOS_MARK(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_OUT_QOS_MARK(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_IN_QOS_METER(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_OUT_QOS_METER(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None)
@@ -2970,8 +2975,8 @@ for (SwitchQoS(.sw = sw, .qos = qos)) {
                 Flow(.logical_datapath = sw._uuid,
                      .stage            = stage,
                      .priority         = qos.priority,
-                     .__match          = qos.__match,
-                     .actions          = "ip.dscp = ${value_action}; next;",
+                     .__match          = qos.__match.intern(),
+                     .actions          = i"ip.dscp = ${value_action}; next;",
                      .stage_hint       = stage_hint(qos._uuid),
                      .io_port          = None,
                      .controller_meter = None)
@@ -2995,9 +3000,9 @@ for (SwitchQoS(.sw = sw, .qos = qos)) {
         if (rate != 0) {
             var stage = if (ingress) { s_SWITCH_IN_QOS_METER() } else { s_SWITCH_OUT_QOS_METER() } in
             var meter_action = if (burst != 0) {
-                    "set_meter(${rate}, ${burst}); next;"
+                    i"set_meter(${rate}, ${burst}); next;"
                 } else {
-                    "set_meter(${rate}); next;"
+                    i"set_meter(${rate}); next;"
                 } in
             /* Ingress and Egress QoS Meter Table.
              *
@@ -3006,7 +3011,7 @@ for (SwitchQoS(.sw = sw, .qos = qos)) {
             Flow(.logical_datapath = sw._uuid,
                  .stage            = stage,
                  .priority         = qos.priority,
-                 .__match          = qos.__match,
+                 .__match          = qos.__match.intern(),
                  .actions          = meter_action,
                  .stage_hint       = stage_hint(qos._uuid),
                  .io_port          = None,
@@ -3022,16 +3027,16 @@ for (&Switch(._uuid = ls_uuid)) {
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_IN_STATEFUL(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_OUT_STATEFUL(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
@@ -3043,16 +3048,16 @@ for (&Switch(._uuid = ls_uuid)) {
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_IN_STATEFUL(),
          .priority         = 100,
-         .__match          = "${rEGBIT_CONNTRACK_COMMIT()} == 1",
-         .actions          = "ct_commit { ct_label.blocked = 0; }; next;",
+         .__match          = i"${rEGBIT_CONNTRACK_COMMIT()} == 1",
+         .actions          = i"ct_commit { ct_label.blocked = 0; }; next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_OUT_STATEFUL(),
          .priority         = 100,
-         .__match          = "${rEGBIT_CONNTRACK_COMMIT()} == 1",
-         .actions          = "ct_commit { ct_label.blocked = 0; }; next;",
+         .__match          = i"${rEGBIT_CONNTRACK_COMMIT()} == 1",
+         .actions          = i"ct_commit { ct_label.blocked = 0; }; next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None)
@@ -3154,8 +3159,8 @@ function build_lb_vip_actions(lbvip: Intern<LBVIPWithStatus>,
 Flow(.logical_datapath = sw._uuid,
      .stage            = s_SWITCH_IN_STATEFUL(),
      .priority         = priority,
-     .__match          = __match,
-     .actions          = actions,
+     .__match          = __match.intern(),
+     .actions          = actions.intern(),
      .io_port          = None,
      .controller_meter = meter,
      .stage_hint       = stage_hint(lb._uuid)) :-
@@ -3196,8 +3201,8 @@ Flow(.logical_datapath = sw._uuid,
 Flow(.logical_datapath = ls_uuid,
      .stage = stage,
      .priority = 0,
-     .__match = "1",
-     .actions = "next;",
+     .__match = i"1",
+     .actions = i"next;",
      .stage_hint = 0,
      .io_port          = None,
      .controller_meter = None) :-
@@ -3214,8 +3219,8 @@ for (&Switch(._uuid = ls_uuid, .has_lb_vip = true)) {
     Flow(.logical_datapath = ls_uuid,
          .stage = s_SWITCH_IN_PRE_HAIRPIN(),
          .priority = 100,
-         .__match = "ip && ct.trk",
-         .actions = "${rEGBIT_HAIRPIN()} = chk_lb_hairpin(); "
+         .__match = i"ip && ct.trk",
+         .actions = i"${rEGBIT_HAIRPIN()} = chk_lb_hairpin(); "
                     "${rEGBIT_HAIRPIN_REPLY()} = chk_lb_hairpin_reply(); "
                     "next;",
          .stage_hint = stage_hint(ls_uuid),
@@ -3227,8 +3232,8 @@ for (&Switch(._uuid = ls_uuid, .has_lb_vip = true)) {
     Flow(.logical_datapath = ls_uuid,
          .stage = s_SWITCH_IN_NAT_HAIRPIN(),
          .priority = 100,
-         .__match = "ip && ct.new && ct.trk && ${rEGBIT_HAIRPIN()} == 1",
-         .actions = "ct_snat_to_vip; next;",
+         .__match = i"ip && ct.new && ct.trk && ${rEGBIT_HAIRPIN()} == 1",
+         .actions = i"ct_snat_to_vip; next;",
          .stage_hint = stage_hint(ls_uuid),
          .io_port = None,
          .controller_meter = None);
@@ -3239,8 +3244,8 @@ for (&Switch(._uuid = ls_uuid, .has_lb_vip = true)) {
     Flow(.logical_datapath = ls_uuid,
          .stage = s_SWITCH_IN_NAT_HAIRPIN(),
          .priority = 100,
-         .__match = "ip && ct.est && ct.trk && ${rEGBIT_HAIRPIN()} == 1",
-         .actions = "ct_snat;",
+         .__match = i"ip && ct.est && ct.trk && ${rEGBIT_HAIRPIN()} == 1",
+         .actions = i"ct_snat;",
          .stage_hint = stage_hint(ls_uuid),
          .io_port = None,
          .controller_meter = None);
@@ -3249,8 +3254,8 @@ for (&Switch(._uuid = ls_uuid, .has_lb_vip = true)) {
     Flow(.logical_datapath = ls_uuid,
          .stage = s_SWITCH_IN_NAT_HAIRPIN(),
          .priority = 90,
-         .__match = "ip && ${rEGBIT_HAIRPIN_REPLY()} == 1",
-         .actions = "ct_snat;",
+         .__match = i"ip && ${rEGBIT_HAIRPIN_REPLY()} == 1",
+         .actions = i"ct_snat;",
          .stage_hint = stage_hint(ls_uuid),
          .io_port = None,
          .controller_meter = None);
@@ -3262,8 +3267,8 @@ for (&Switch(._uuid = ls_uuid, .has_lb_vip = true)) {
     Flow(.logical_datapath = ls_uuid,
          .stage = s_SWITCH_IN_HAIRPIN(),
          .priority = 1,
-         .__match = "(${rEGBIT_HAIRPIN()} == 1 || ${rEGBIT_HAIRPIN_REPLY()} == 1)",
-         .actions = "eth.dst <-> eth.src; outport = inport; flags.loopback = 1; output;",
+         .__match = i"(${rEGBIT_HAIRPIN()} == 1 || ${rEGBIT_HAIRPIN_REPLY()} == 1)",
+         .actions = i"eth.dst <-> eth.src; outport = inport; flags.loopback = 1; output;",
          .stage_hint = stage_hint(ls_uuid),
          .io_port = None,
          .controller_meter = None)
@@ -3276,13 +3281,13 @@ for (&SwitchPort(.lsp = lsp, .sw = sw, .json_name = json_name, .ps_eth_addresses
      if lsp.is_enabled() and lsp.__type != "external") {
      for (pbinding in sb::Out_Port_Binding(.logical_port = lsp.name)) {
         var __match = if (ps_eth_addresses.is_empty()) {
-                "inport == ${json_name}"
+                i"inport == ${json_name}"
             } else {
-                "inport == ${json_name} && eth.src == {${ps_eth_addresses.join(\" \")}}"
+                i"inport == ${json_name} && eth.src == {${ps_eth_addresses.join(\" \")}}"
             } in
         var actions = match (pbinding.options.get("qdisc_queue_id")) {
-                None -> "next;",
-                Some{id} -> "set_queue(${id}); next;"
+                None -> i"next;",
+                Some{id} -> i"set_queue(${id}); next;"
             } in
         Flow(.logical_datapath = sw._uuid,
              .stage            = s_SWITCH_IN_PORT_SEC_L2(),
@@ -3316,7 +3321,7 @@ for (SwitchPortPSAddresses(.port = port@&SwitchPort{.sw = sw}, .ps_addrs = ps)
         port.lsp.__type != "external")
 {
     if (ps.ipv4_addrs.len() > 0) {
-        var dhcp_match = "inport == ${port.json_name}"
+        var dhcp_match = i"inport == ${port.json_name}"
                          " && eth.src == ${ps.ea}"
                          " && ip4.src == 0.0.0.0"
                          " && ip4.dst == 255.255.255.255"
@@ -3325,7 +3330,7 @@ for (SwitchPortPSAddresses(.port = port@&SwitchPort{.sw = sw}, .ps_addrs = ps)
                  .stage            = s_SWITCH_IN_PORT_SEC_IP(),
                  .priority         = 90,
                  .__match          = dhcp_match,
-                 .actions          = "next;",
+                 .actions          = i"next;",
                  .stage_hint       = stage_hint(port.lsp._uuid),
                  .io_port          = Some{port.lsp.name},
                  .controller_meter = None)
@@ -3349,15 +3354,15 @@ for (SwitchPortPSAddresses(.port = port@&SwitchPort{.sw = sw}, .ps_addrs = ps)
             Flow(.logical_datapath = sw._uuid,
                  .stage         = s_SWITCH_IN_PORT_SEC_IP(),
                  .priority         = 90,
-                 .__match          = __match,
-                 .actions          = "next;",
+                 .__match          = __match.intern(),
+                 .actions          = i"next;",
                  .stage_hint       = stage_hint(port.lsp._uuid),
                  .io_port          = Some{port.lsp.name},
                  .controller_meter = None)
         }
     };
     if (ps.ipv6_addrs.len() > 0) {
-        var dad_match = "inport == ${port.json_name}"
+        var dad_match = i"inport == ${port.json_name}"
                         " && eth.src == ${ps.ea}"
                         " && ip6.src == ::"
                         " && ip6.dst == ff02::/16"
@@ -3367,7 +3372,7 @@ for (SwitchPortPSAddresses(.port = port@&SwitchPort{.sw = sw}, .ps_addrs = ps)
                  .stage            = s_SWITCH_IN_PORT_SEC_IP(),
                  .priority         = 90,
                  .__match          = dad_match,
-                 .actions          = "next;",
+                 .actions          = i"next;",
                  .stage_hint       = stage_hint(port.lsp._uuid),
                  .io_port          = None,
                  .controller_meter = None)
@@ -3378,20 +3383,20 @@ for (SwitchPortPSAddresses(.port = port@&SwitchPort{.sw = sw}, .ps_addrs = ps)
             Flow(.logical_datapath = sw._uuid,
                  .stage            = s_SWITCH_IN_PORT_SEC_IP(),
                  .priority         = 90,
-                 .__match          = __match,
-                 .actions          = "next;",
+                 .__match          = __match.intern(),
+                 .actions          = i"next;",
                  .stage_hint       = stage_hint(port.lsp._uuid),
                  .io_port          = Some{port.lsp.name},
                  .controller_meter = None)
         }
     };
-    var __match = "inport == ${port.json_name} && eth.src == ${ps.ea} && ip" in
+    var __match = i"inport == ${port.json_name} && eth.src == ${ps.ea} && ip" in
     {
         Flow(.logical_datapath = sw._uuid,
              .stage            = s_SWITCH_IN_PORT_SEC_IP(),
              .priority         = 80,
              .__match          = __match,
-             .actions          = "drop;",
+             .actions          = i"drop;",
              .stage_hint       = stage_hint(port.lsp._uuid),
              .io_port          = Some{port.lsp.name},
              .controller_meter = None)
@@ -3440,8 +3445,8 @@ for (SwitchPortPSAddresses(.port = port@&SwitchPort{.sw = sw}, .ps_addrs = ps)
                 Flow(.logical_datapath = sw._uuid,
                      .stage            = s_SWITCH_IN_PORT_SEC_ND(),
                      .priority         = 90,
-                     .__match          = __match,
-                     .actions          = "next;",
+                     .__match          = __match.intern(),
+                     .actions          = i"next;",
                      .stage_hint       = stage_hint(port.lsp._uuid),
                      .io_port          = Some{port.lsp.name},
                      .controller_meter = None)
@@ -3454,8 +3459,8 @@ for (SwitchPortPSAddresses(.port = port@&SwitchPort{.sw = sw}, .ps_addrs = ps)
                 Flow(.logical_datapath = sw._uuid,
                      .stage            = s_SWITCH_IN_PORT_SEC_ND(),
                      .priority         = 90,
-                     .__match          = __match,
-                     .actions          = "next;",
+                     .__match          = __match.intern(),
+                     .actions          = i"next;",
                      .stage_hint       = stage_hint(port.lsp._uuid),
                      .io_port          = Some{port.lsp.name},
                      .controller_meter = None)
@@ -3464,8 +3469,8 @@ for (SwitchPortPSAddresses(.port = port@&SwitchPort{.sw = sw}, .ps_addrs = ps)
         Flow(.logical_datapath = sw._uuid,
              .stage            = s_SWITCH_IN_PORT_SEC_ND(),
              .priority         = 80,
-             .__match          = "inport == ${port.json_name} && (arp || nd)",
-             .actions          = "drop;",
+             .__match          = i"inport == ${port.json_name} && (arp || nd)",
+             .actions          = i"drop;",
              .stage_hint       = stage_hint(port.lsp._uuid),
              .io_port          = Some{port.lsp.name},
              .controller_meter = None)
@@ -3478,16 +3483,16 @@ for (&Switch(._uuid = ls_uuid)) {
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_IN_PORT_SEC_ND(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_IN_PORT_SEC_IP(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None)
@@ -3503,8 +3508,8 @@ for (&SwitchPort(.lsp = lsp, .sw = sw, .json_name = json_name)
     Flow(.logical_datapath = sw._uuid,
          .stage            = s_SWITCH_IN_ARP_ND_RSP(),
          .priority         = 100,
-         .__match          = "inport == ${json_name}",
-         .actions          = "next;",
+         .__match          = i"inport == ${json_name}",
+         .actions          = i"next;",
          .stage_hint       = stage_hint(lsp._uuid),
          .io_port          = Some{lsp.name},
          .controller_meter = None)
@@ -3526,10 +3531,10 @@ function lsp_is_up(lsp: Intern<nb::Logical_Switch_Port>): bool = {
  Flow(.logical_datapath = sp.sw._uuid,
       .stage            = s_SWITCH_IN_ARP_ND_RSP(),
       .priority         = 100,
-      .__match          = "inport == ${vp.json_name} && "
+      .__match          = i"inport == ${vp.json_name} && "
                           "((arp.op == 1 && arp.spa == ${virtual_ip} && arp.tpa == ${virtual_ip}) || "
                           "(arp.op == 2 && arp.spa == ${virtual_ip}))",
-      .actions          = "bind_vport(${sp.json_name}, inport); next;",
+      .actions          = i"bind_vport(${sp.json_name}, inport); next;",
       .stage_hint       = stage_hint(lsp._uuid),
       .io_port          = Some{vp.lsp.name},
       .controller_meter = None) :-
@@ -3559,7 +3564,7 @@ for (CheckLspIsUp[check_lsp_is_up]) {
     {
         var __match = "arp.tpa == ${addr.addr} && arp.op == 1" in
         {
-            var actions = "eth.dst = eth.src; "
+            var actions = i"eth.dst = eth.src; "
                           "eth.src = ${ea}; "
                           "arp.op = 2; /* ARP reply */ "
                           "arp.tha = arp.sha; "
@@ -3572,7 +3577,7 @@ for (CheckLspIsUp[check_lsp_is_up]) {
             Flow(.logical_datapath = sw._uuid,
                  .stage            = s_SWITCH_IN_ARP_ND_RSP(),
                  .priority         = 50,
-                 .__match          = __match,
+                 .__match          = __match.intern(),
                  .actions          = actions,
                  .stage_hint       = stage_hint(lsp._uuid),
                  .io_port          = None,
@@ -3593,8 +3598,8 @@ for (CheckLspIsUp[check_lsp_is_up]) {
             Flow(.logical_datapath = sw._uuid,
                  .stage            = s_SWITCH_IN_ARP_ND_RSP(),
                  .priority         = 100,
-                 .__match          = __match ++ " && inport == ${json_name}",
-                 .actions          = "next;",
+                 .__match          = i"${__match} && inport == ${json_name}",
+                 .actions          = i"next;",
                  .stage_hint       = stage_hint(lsp._uuid),
                  .io_port          = Some{lsp.name},
                  .controller_meter = None)
@@ -3605,7 +3610,7 @@ for (CheckLspIsUp[check_lsp_is_up]) {
 Flow(.logical_datapath = sw._uuid,
          .stage            = s_SWITCH_IN_ARP_ND_RSP(),
          .priority         = 50,
-         .__match          = __match,
+         .__match          = __match.intern(),
          .actions          = __actions,
          .stage_hint       = stage_hint(sp.lsp._uuid),
          .io_port          = None,
@@ -3632,7 +3637,7 @@ Flow(.logical_datapath = sw._uuid,
     },
     proxy_ips != "",
     var __match = "arp.op == 1 && arp.tpa == {" ++ proxy_ips ++ "}",
-    var __actions = "eth.dst = eth.src; "
+    var __actions = i"eth.dst = eth.src; "
                     "eth.src = ${rp.networks.ea}; "
                     "arp.op = 2; /* ARP reply */ "
                     "arp.tha = arp.sha; "
@@ -3653,7 +3658,7 @@ for (SwitchPortIPv6Address(.port = &SwitchPort{.lsp = lsp, .json_name = json_nam
         not sw.is_vlan_transparent)
 {
     var __match = "nd_ns && ip6.dst == {${addr.addr}, ${addr.solicited_node()}} && nd.target == ${addr.addr}" in
-    var actions = "${if (lsp.__type == \"router\") \"nd_na_router\" else \"nd_na\"} { "
+    var actions = i"${if (lsp.__type == \"router\") \"nd_na_router\" else \"nd_na\"} { "
                   "eth.src = ${ea}; "
                   "ip6.src = ${addr.addr}; "
                   "nd.target = ${addr.addr}; "
@@ -3666,7 +3671,7 @@ for (SwitchPortIPv6Address(.port = &SwitchPort{.lsp = lsp, .json_name = json_nam
         Flow(.logical_datapath = sw._uuid,
              .stage            = s_SWITCH_IN_ARP_ND_RSP(),
              .priority         = 50,
-             .__match          = __match,
+             .__match          = __match.intern(),
              .actions          = actions,
              .io_port          = None,
              .controller_meter = sw.copp.get(cOPP_ND_NA()),
@@ -3677,8 +3682,8 @@ for (SwitchPortIPv6Address(.port = &SwitchPort{.lsp = lsp, .json_name = json_nam
         Flow(.logical_datapath = sw._uuid,
              .stage            = s_SWITCH_IN_ARP_ND_RSP(),
              .priority         = 100,
-             .__match          = __match ++ " && inport == ${json_name}",
-             .actions          = "next;",
+             .__match          = i"${__match} && inport == ${json_name}",
+             .actions          = i"next;",
              .stage_hint       = stage_hint(lsp._uuid),
              .io_port          = Some{lsp.name},
              .controller_meter = None)
@@ -3691,8 +3696,8 @@ for (ls in nb::Logical_Switch) {
     Flow(.logical_datapath = ls._uuid,
          .stage            = s_SWITCH_IN_ARP_ND_RSP(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None)
@@ -3703,8 +3708,8 @@ for (ls in nb::Logical_Switch) {
 Flow(.logical_datapath = sp.sw._uuid,
      .stage            = s_SWITCH_IN_ARP_ND_RSP(),
      .priority         = 110,
-     .__match          = "arp.tpa == ${svc_mon_src_ip} && arp.op == 1",
-     .actions          = "eth.dst = eth.src; "
+     .__match          = i"arp.tpa == ${svc_mon_src_ip} && arp.op == 1",
+     .actions          = i"eth.dst = eth.src; "
                          "eth.src = ${svc_monitor_mac}; "
                          "arp.op = 2; /* ARP reply */ "
                          "arp.tha = arp.sha; "
@@ -3729,7 +3734,7 @@ function build_dhcpv4_action(
     lsp_json_key: string,
     dhcpv4_options: Intern<nb::DHCP_Options>,
     offer_ip: in_addr,
-    lsp_options: Map<string,string>) : Option<(string, string, string)> =
+    lsp_options: Map<string,string>) : Option<(istring, istring, string)> =
 {
     match (ip_parse_masked(dhcpv4_options.cidr)) {
         Left{err} -> {
@@ -3768,13 +3773,13 @@ function build_dhcpv4_action(
                         };
                         var options_action = "${rEGBIT_DHCP_OPTS_RESULT()} = put_dhcp_opts(offerip = ${offer_ip}, " ++
                                              options.join(", ") ++ "); next;";
-                        var response_action = "eth.dst = eth.src; eth.src = ${server_mac}; "
+                        var response_action = i"eth.dst = eth.src; eth.src = ${server_mac}; "
                                               "ip4.src = ${server_ip}; udp.src = 67; "
                                               "udp.dst = 68; outport = inport; flags.loopback = 1; "
                                               "output;";
 
                         var ipv4_addr_match = "ip4.src == ${offer_ip} && ip4.dst == {${server_ip}, 255.255.255.255}";
-                        Some{(options_action, response_action, ipv4_addr_match)}
+                        Some{(options_action.intern(), response_action, ipv4_addr_match)}
                     },
                     _ -> {
                         /* "server_id", "server_mac" and "lease_time" should be
@@ -3792,7 +3797,7 @@ function build_dhcpv4_action(
 function build_dhcpv6_action(
     lsp_json_key: string,
     dhcpv6_options: Intern<nb::DHCP_Options>,
-    offer_ip: in6_addr): Option<(string, string)> =
+    offer_ip: in6_addr): Option<(istring, istring)> =
 {
     match (ipv6_parse_masked(dhcpv6_options.cidr)) {
         Left{err} -> {
@@ -3844,11 +3849,11 @@ function build_dhcpv6_action(
                                 var options_action = "${rEGBIT_DHCP_OPTS_RESULT()} = put_dhcpv6_opts(" ++
                                                      options.join(", ") ++
                                                      "); next;";
-                                var response_action = "eth.dst = eth.src; eth.src = ${server_mac}; "
+                                var response_action = i"eth.dst = eth.src; eth.src = ${server_mac}; "
                                                       "ip6.dst = ip6.src; ip6.src = ${server_ip}; udp.src = 547; "
                                                        "udp.dst = 546; outport = inport; flags.loopback = 1; "
                                                        "output;";
-                                Some{(options_action, response_action)}
+                                Some{(options_action.intern(), response_action)}
                             }
                         }
                     }
@@ -3924,9 +3929,9 @@ for (lsp in &SwitchPort
                             build_dhcpv4_action(json_key, dhcpv4_options, addr.addr, lsp.lsp.options) in
                         {
                             var __match =
-                                pfx ++ "eth.src == ${ea} && "
+                                (pfx ++ "eth.src == ${ea} && "
                                 "ip4.src == 0.0.0.0 && ip4.dst == 255.255.255.255 && "
-                                "udp.src == 68 && udp.dst == 67" ++ sfx
+                                "udp.src == 68 && udp.dst == 67" ++ sfx).intern()
                             in
                             Flow(.logical_datapath = lsuuid,
                                  .stage            = s_SWITCH_IN_DHCP_OPTIONS(),
@@ -3950,7 +3955,7 @@ for (lsp in &SwitchPort
                             Flow(.logical_datapath = lsuuid,
                                  .stage            = s_SWITCH_IN_DHCP_OPTIONS(),
                                  .priority         = 100,
-                                 .__match          = __match,
+                                 .__match          = __match.intern(),
                                  .actions          = options_action,
                                  .io_port          = None,
                                  .controller_meter = lsp.sw.copp.get(cOPP_DHCPV4_OPTS()),
@@ -3964,7 +3969,7 @@ for (lsp in &SwitchPort
                             Flow(.logical_datapath = lsuuid,
                                  .stage            = s_SWITCH_IN_DHCP_RESPONSE(),
                                  .priority         = 100,
-                                 .__match          = __match,
+                                 .__match          = __match.intern(),
                                  .actions          = response_action,
                                  .stage_hint       = stage_hint(lsp.lsp._uuid),
                                  .io_port          = None,
@@ -3993,7 +3998,7 @@ for (lsp in &SwitchPort
                                 Flow(.logical_datapath = lsuuid,
                                      .stage            = s_SWITCH_IN_DHCP_OPTIONS(),
                                      .priority         = 100,
-                                     .__match          = __match,
+                                     .__match          = __match.intern(),
                                      .actions          = options_action,
                                      .io_port          = None,
                                      .controller_meter = lsp.sw.copp.get(cOPP_DHCPV6_OPTS()),
@@ -4004,7 +4009,7 @@ for (lsp in &SwitchPort
                                 Flow(.logical_datapath = lsuuid,
                                      .stage            = s_SWITCH_IN_DHCP_RESPONSE(),
                                      .priority         = 100,
-                                     .__match          = __match ++ " && ${rEGBIT_DHCP_OPTS_RESULT()}",
+                                     .__match          = (__match ++ " && ${rEGBIT_DHCP_OPTS_RESULT()}").intern(),
                                      .actions          = response_action,
                                      .stage_hint       = stage_hint(lsp.lsp._uuid),
                                      .io_port          = None,
@@ -4030,31 +4035,31 @@ for (LogicalSwitchHasDNSRecords(ls, true))
     Flow(.logical_datapath = ls,
          .stage            = s_SWITCH_IN_DNS_LOOKUP(),
          .priority         = 100,
-         .__match          = "udp.dst == 53",
-         .actions          = "${rEGBIT_DNS_LOOKUP_RESULT()} = dns_lookup(); next;",
+         .__match          = i"udp.dst == 53",
+         .actions          = i"${rEGBIT_DNS_LOOKUP_RESULT()} = dns_lookup(); next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
 
-    var action = "eth.dst <-> eth.src; ip4.src <-> ip4.dst; "
+    var action = i"eth.dst <-> eth.src; ip4.src <-> ip4.dst; "
                  "udp.dst = udp.src; udp.src = 53; outport = inport; "
                  "flags.loopback = 1; output;" in
     Flow(.logical_datapath = ls,
          .stage            = s_SWITCH_IN_DNS_RESPONSE(),
          .priority         = 100,
-         .__match          = "udp.dst == 53 && ${rEGBIT_DNS_LOOKUP_RESULT()}",
+         .__match          = i"udp.dst == 53 && ${rEGBIT_DNS_LOOKUP_RESULT()}",
          .actions          = action,
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
 
-    var action = "eth.dst <-> eth.src; ip6.src <-> ip6.dst; "
+    var action = i"eth.dst <-> eth.src; ip6.src <-> ip6.dst; "
                  "udp.dst = udp.src; udp.src = 53; outport = inport; "
                  "flags.loopback = 1; output;" in
     Flow(.logical_datapath = ls,
          .stage            = s_SWITCH_IN_DNS_RESPONSE(),
          .priority         = 100,
-         .__match          = "udp.dst == 53 && ${rEGBIT_DNS_LOOKUP_RESULT()}",
+         .__match          = i"udp.dst == 53 && ${rEGBIT_DNS_LOOKUP_RESULT()}",
          .actions          = action,
          .stage_hint       = 0,
          .io_port          = None,
@@ -4073,8 +4078,8 @@ for (ls in nb::Logical_Switch) {
     Flow(.logical_datapath = ls._uuid,
          .stage            = s_SWITCH_IN_DHCP_OPTIONS(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
@@ -4082,8 +4087,8 @@ for (ls in nb::Logical_Switch) {
     Flow(.logical_datapath = ls._uuid,
          .stage            = s_SWITCH_IN_DHCP_RESPONSE(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
@@ -4091,8 +4096,8 @@ for (ls in nb::Logical_Switch) {
     Flow(.logical_datapath = ls._uuid,
          .stage            = s_SWITCH_IN_DNS_LOOKUP(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
@@ -4100,8 +4105,8 @@ for (ls in nb::Logical_Switch) {
     Flow(.logical_datapath = ls._uuid,
          .stage            = s_SWITCH_IN_DNS_RESPONSE(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
@@ -4109,8 +4114,8 @@ for (ls in nb::Logical_Switch) {
     Flow(.logical_datapath = ls._uuid,
          .stage            = s_SWITCH_IN_EXTERNAL_PORT(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None)
@@ -4119,8 +4124,8 @@ for (ls in nb::Logical_Switch) {
 Flow(.logical_datapath = sw._uuid,
      .stage = s_SWITCH_IN_L2_LKUP(),
      .priority = 110,
-     .__match = "eth.dst == $svc_monitor_mac",
-     .actions = "handle_svc_check(inport);",
+     .__match = i"eth.dst == $svc_monitor_mac",
+     .actions = i"handle_svc_check(inport);",
      .stage_hint = 0,
      .io_port          = None,
      .controller_meter = None) :-
@@ -4138,20 +4143,20 @@ for (sw in &Switch(._uuid = ls_uuid, .mcast_cfg = mcast_cfg)
                 var igmp_act = {
                     if (flood_reports) {
                         var mrouter_static = json_string_escape(mC_MROUTER_STATIC().0);
-                        "clone { "
+                        i"clone { "
                             "outport = ${mrouter_static}; "
                             "output; "
                         "};igmp;"
                     } else {
-                        "igmp;"
+                        i"igmp;"
                     }
                 } in {
                     /* Punt IGMP traffic to controller. */
                     Flow(.logical_datapath = ls_uuid,
                          .stage            = s_SWITCH_IN_L2_LKUP(),
                          .priority         = 100,
-                         .__match          = "ip4 && ip.proto == 2",
-                         .actions          = "${igmp_act}",
+                         .__match          = i"ip4 && ip.proto == 2",
+                         .actions          = i"${igmp_act}",
                          .io_port          = None,
                          .controller_meter = controller_meter,
                          .stage_hint       = 0);
@@ -4160,8 +4165,8 @@ for (sw in &Switch(._uuid = ls_uuid, .mcast_cfg = mcast_cfg)
                     Flow(.logical_datapath = ls_uuid,
                          .stage            = s_SWITCH_IN_L2_LKUP(),
                          .priority         = 100,
-                         .__match          = "mldv1 || mldv2",
-                         .actions          = "${igmp_act}",
+                         .__match          = i"mldv1 || mldv2",
+                         .actions          = igmp_act,
                          .io_port          = None,
                          .controller_meter = controller_meter,
                          .stage_hint       = 0);
@@ -4173,8 +4178,8 @@ for (sw in &Switch(._uuid = ls_uuid, .mcast_cfg = mcast_cfg)
                     Flow(.logical_datapath = ls_uuid,
                          .stage            = s_SWITCH_IN_L2_LKUP(),
                          .priority         = 85,
-                         .__match          = "ip4.mcast && ip4.dst == 224.0.0.0/24",
-                         .actions          = "outport = ${flood}; output;",
+                         .__match          = i"ip4.mcast && ip4.dst == 224.0.0.0/24",
+                         .actions          = i"outport = ${flood}; output;",
                          .stage_hint       = 0,
                          .io_port          = None,
                          .controller_meter = None);
@@ -4186,8 +4191,8 @@ for (sw in &Switch(._uuid = ls_uuid, .mcast_cfg = mcast_cfg)
                     Flow(.logical_datapath = ls_uuid,
                          .stage            = s_SWITCH_IN_L2_LKUP(),
                          .priority         = 85,
-                         .__match          = "ip6.mcast_flood",
-                         .actions          = "outport = ${flood}; output;",
+                         .__match          = i"ip6.mcast_flood",
+                         .actions          = i"outport = ${flood}; output;",
                          .stage_hint       = 0,
                          .io_port          = None,
                          .controller_meter = None);
@@ -4227,10 +4232,9 @@ for (sw in &Switch(._uuid = ls_uuid, .mcast_cfg = mcast_cfg)
                         Flow(.logical_datapath = ls_uuid,
                              .stage            = s_SWITCH_IN_L2_LKUP(),
                              .priority         = 80,
-                             .__match          = "ip4.mcast || ip6.mcast",
-                             .actions          =
-                                "${relay_act}${static_act}${drop_act}",
-                                        .stage_hint       = 0,
+                             .__match          = i"ip4.mcast || ip6.mcast",
+                             .actions          = i"${relay_act}${static_act}${drop_act}",
+                             .stage_hint       = 0,
                              .io_port          = None,
                              .controller_meter = None)
                     }
@@ -4283,9 +4287,9 @@ for (IgmpSwitchMulticastGroup(.address = address, .switch = sw)) {
             Flow(.logical_datapath = sw._uuid,
                  .stage            = s_SWITCH_IN_L2_LKUP(),
                  .priority         = 90,
-                 .__match          = "eth.mcast && ${ipX} && ${ipX}.dst == ${address}",
+                 .__match          = i"eth.mcast && ${ipX} && ${ipX}.dst == ${address}",
                  .actions          =
-                    "${relay_act} ${static_act} outport = \"${address}\"; "
+                    i"${relay_act} ${static_act} outport = \"${address}\"; "
                     "output;",
                  .stage_hint       = 0,
                  .io_port          = None,
@@ -4305,11 +4309,11 @@ for (IgmpSwitchMulticastGroup(.address = address, .switch = sw)) {
 Flow(.logical_datapath = sp.sw._uuid,
      .stage            = s_SWITCH_IN_EXTERNAL_PORT(),
      .priority         = 100,
-     .__match          = ("inport == ${json_string_escape(localnet_port.1)} && "
+     .__match          = (i"inport == ${json_string_escape(localnet_port.1)} && "
                           "eth.src == ${lp_addr.ea} && "
                           "!is_chassis_resident(${sp.json_name}) && "
                           "arp.tpa == ${rp_addr.addr} && arp.op == 1"),
-     .actions          = "drop;",
+     .actions          = i"drop;",
      .stage_hint       = stage_hint(sp.lsp._uuid),
      .io_port          = Some{localnet_port.1},
      .controller_meter = None) :-
@@ -4323,12 +4327,12 @@ Flow(.logical_datapath = sp.sw._uuid,
 Flow(.logical_datapath = sp.sw._uuid,
      .stage            = s_SWITCH_IN_EXTERNAL_PORT(),
      .priority         = 100,
-     .__match          = ("inport == ${json_string_escape(localnet_port.1)} && "
+     .__match          = (i"inport == ${json_string_escape(localnet_port.1)} && "
                           "eth.src == ${lp_addr.ea} && "
                           "!is_chassis_resident(${sp.json_name}) && "
                           "nd_ns && ip6.dst == {${rp_addr.addr}, ${rp_addr.solicited_node()}} && "
                           "nd.target == ${rp_addr.addr}"),
-     .actions          = "drop;",
+     .actions          = i"drop;",
      .stage_hint       = stage_hint(sp.lsp._uuid),
      .io_port          = Some{localnet_port.1},
      .controller_meter = None) :-
@@ -4342,11 +4346,11 @@ Flow(.logical_datapath = sp.sw._uuid,
 Flow(.logical_datapath = sp.sw._uuid,
      .stage            = s_SWITCH_IN_EXTERNAL_PORT(),
      .priority         = 100,
-     .__match          = ("inport == ${json_string_escape(localnet_port.1)} && "
+     .__match          = (i"inport == ${json_string_escape(localnet_port.1)} && "
                           "eth.src == ${lp_addr.ea} && "
                           "eth.dst == ${ea} && "
                           "!is_chassis_resident(${sp.json_name})"),
-     .actions          = "drop;",
+     .actions          = i"drop;",
      .stage_hint       = stage_hint(sp.lsp._uuid),
      .io_port          = Some{localnet_port.1},
      .controller_meter = None) :-
@@ -4365,8 +4369,8 @@ for (ls in nb::Logical_Switch) {
     Flow(.logical_datapath = ls._uuid,
          .stage            = s_SWITCH_IN_L2_LKUP(),
          .priority         = 70,
-         .__match          = "eth.mcast",
-         .actions          = "outport = ${mc_flood}; output;",
+         .__match          = i"eth.mcast",
+         .actions          = i"outport = ${mc_flood}; output;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None)
@@ -4380,8 +4384,8 @@ for (SwitchPortStaticAddresses(.port = &SwitchPort{.lsp = lsp, .json_name = json
     Flow(.logical_datapath = sw._uuid,
          .stage            = s_SWITCH_IN_L2_LKUP(),
          .priority         = 50,
-         .__match          = "eth.dst == ${addrs.ea}",
-         .actions          = "outport = ${json_name}; output;",
+         .__match          = i"eth.dst == ${addrs.ea}",
+         .actions          = i"outport = ${json_name}; output;",
          .stage_hint       = stage_hint(lsp._uuid),
          .io_port          = None,
          .controller_meter = None)
@@ -4444,9 +4448,9 @@ Flow(.logical_datapath = sw._uuid,
         eth_src_set
     },
     var eth_src = "{" ++ eth_src_set.to_vec().join(", ") ++ "}",
-    var __match = "eth.src == ${eth_src} && (arp.op == 1 || nd_ns)",
+    var __match = i"eth.src == ${eth_src} && (arp.op == 1 || nd_ns)",
     var mc_flood_l2 = json_string_escape(mC_FLOOD_L2().0),
-    var actions = "outport = ${mc_flood_l2}; output;".
+    var actions = i"outport = ${mc_flood_l2}; output;".
 
 /* Forward ARP requests for owned IP addresses (L3, VIP, NAT) only to this
  * router port.
@@ -4544,13 +4548,12 @@ relation &SwitchPortARPForwards(
 Flow(.logical_datapath = sw._uuid,
      .stage            = s_SWITCH_IN_L2_LKUP(),
      .priority         = 80,
-     .__match          = fLAGBIT_NOT_VXLAN() ++
-                         " && arp.op == 1 && arp.tpa == " ++ ipv4,
+     .__match          = i"${fLAGBIT_NOT_VXLAN()} && arp.op == 1 && arp.tpa == ${ipv4}",
      .actions          = if (sw.has_non_router_port) {
-                             "clone {outport = ${sp.json_name}; output; }; "
+                             i"clone {outport = ${sp.json_name}; output; }; "
                              "outport = ${mc_flood_l2}; output;"
                          } else {
-                             "outport = ${sp.json_name}; output;"
+                             i"outport = ${sp.json_name}; output;"
                          },
      .stage_hint       = stage_hint(sp.lsp._uuid),
      .io_port          = None,
@@ -4563,13 +4566,12 @@ Flow(.logical_datapath = sw._uuid,
 Flow(.logical_datapath = sw._uuid,
      .stage            = s_SWITCH_IN_L2_LKUP(),
      .priority         = 80,
-     .__match          = fLAGBIT_NOT_VXLAN() ++
-                         " && nd_ns && nd.target == " ++ ipv6,
+     .__match          = i"${fLAGBIT_NOT_VXLAN()} && nd_ns && nd.target == ${ipv6}",
      .actions          = if (sw.has_non_router_port) {
-                             "clone {outport = ${sp.json_name}; output; }; "
+                             i"clone {outport = ${sp.json_name}; output; }; "
                              "outport = ${mc_flood_l2}; output;"
                          } else {
-                             "outport = ${sp.json_name}; output;"
+                             i"outport = ${sp.json_name}; output;"
                          },
      .stage_hint       = stage_hint(sp.lsp._uuid),
      .io_port          = None,
@@ -4583,9 +4585,8 @@ Flow(.logical_datapath = sw._uuid,
 Flow(.logical_datapath = sw._uuid,
      .stage            = s_SWITCH_IN_L2_LKUP(),
      .priority         = 90,
-     .__match          = fLAGBIT_NOT_VXLAN() ++
-                        " && arp.op == 1 && arp.tpa == " ++ ipv4,
-     .actions          = "outport = ${flood}; output;",
+     .__match          = i"${fLAGBIT_NOT_VXLAN()} && arp.op == 1 && arp.tpa == ${ipv4}",
+     .actions          = i"outport = ${flood}; output;",
      .stage_hint       = stage_hint(sp.lsp._uuid),
      .io_port          = None,
      .controller_meter = None) :-
@@ -4598,9 +4599,8 @@ Flow(.logical_datapath = sw._uuid,
 Flow(.logical_datapath = sw._uuid,
      .stage            = s_SWITCH_IN_L2_LKUP(),
      .priority         = 90,
-     .__match          = fLAGBIT_NOT_VXLAN() ++
-                         " && nd_ns && nd.target == " ++ ipv6,
-     .actions          = "outport = ${flood}; output;",
+     .__match          = i"${fLAGBIT_NOT_VXLAN()} && nd_ns && nd.target == ${ipv6}",
+     .actions          = i"outport = ${flood}; output;",
      .stage_hint       = stage_hint(sp.lsp._uuid),
      .io_port          = None,
      .controller_meter = None) :-
@@ -4616,8 +4616,8 @@ for (SwitchPortNewDynamicAddress(.port = &SwitchPort{.lsp = lsp, .json_name = js
     Flow(.logical_datapath = sw._uuid,
          .stage            = s_SWITCH_IN_L2_LKUP(),
          .priority         = 50,
-         .__match          = "eth.dst == ${addrs.ea}",
-         .actions          = "outport = ${json_name}; output;",
+         .__match          = i"eth.dst == ${addrs.ea}",
+         .actions          = i"outport = ${json_name}; output;",
          .stage_hint       = stage_hint(lsp._uuid),
          .io_port          = None,
          .controller_meter = None)
@@ -4660,15 +4660,15 @@ for (&SwitchPort(.lsp = lsp,
             /* The destination lookup flow for the router's
              * distributed gateway port MAC address should only be
              * programmed on the "redirect-chassis". */
-            "eth.dst == ${mac} && is_chassis_resident(${redirect_port_name})"
+            i"eth.dst == ${mac} && is_chassis_resident(${redirect_port_name})"
         } else {
-            "eth.dst == ${mac}"
+            i"eth.dst == ${mac}"
         } in
         Flow(.logical_datapath = sw._uuid,
              .stage            = s_SWITCH_IN_L2_LKUP(),
              .priority         = 50,
              .__match          = __match,
-             .actions          = "outport = ${json_name}; output;",
+             .actions          = i"outport = ${json_name}; output;",
              .stage_hint       = stage_hint(lsp._uuid),
              .io_port          = None,
              .controller_meter = None);
@@ -4681,12 +4681,12 @@ for (&SwitchPort(.lsp = lsp,
                     Some{var lport} = nat.nat.logical_port in
                     Some{var emac} = nat.nat.external_mac in
                     Some{var nat_mac} = eth_addr_from_string(emac) in
-                    var __match = "eth.dst == ${nat_mac} && is_chassis_resident(${json_string_escape(lport)})" in
+                    var __match = i"eth.dst == ${nat_mac} && is_chassis_resident(${json_string_escape(lport)})" in
                     Flow(.logical_datapath = sw._uuid,
                          .stage            = s_SWITCH_IN_L2_LKUP(),
                          .priority         = 50,
                          .__match          = __match,
-                         .actions          = "outport = ${json_name}; output;",
+                         .actions          = i"outport = ${json_name}; output;",
                          .stage_hint       = stage_hint(nat.nat._uuid),
                          .io_port          = None,
                          .controller_meter = None)
@@ -4709,8 +4709,8 @@ for (sw in &Switch(._uuid = ls_uuid)) {
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_IN_L2_LKUP(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "outport = get_fdb(eth.dst); next;",
+         .__match          = i"1",
+         .actions          = i"outport = get_fdb(eth.dst); next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
@@ -4718,12 +4718,12 @@ for (sw in &Switch(._uuid = ls_uuid)) {
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_IN_L2_UNKNOWN(),
          .priority         = 50,
-         .__match          = "outport == \"none\"",
+         .__match          = i"outport == \"none\"",
          .actions          = if (sw.has_unknown_ports) {
                                  var mc_unknown = json_string_escape(mC_UNKNOWN().0);
-                                 "outport = ${mc_unknown}; output;"
+                                 i"outport = ${mc_unknown}; output;"
                              } else {
-                                 "drop;"
+                                 i"drop;"
                              },
          .stage_hint       = 0,
          .io_port          = None,
@@ -4732,8 +4732,8 @@ for (sw in &Switch(._uuid = ls_uuid)) {
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_IN_L2_UNKNOWN(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "output;",
+         .__match          = i"1",
+         .actions          = i"output;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None)
@@ -4745,16 +4745,16 @@ for (&Switch(._uuid = ls_uuid)) {
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_OUT_PORT_SEC_IP(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
     Flow(.logical_datapath = ls_uuid,
          .stage            = s_SWITCH_OUT_PORT_SEC_L2(),
          .priority         = 100,
-         .__match          = "eth.mcast",
-         .actions          = "output;",
+         .__match          = i"eth.mcast",
+         .actions          = i"output;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None)
@@ -4763,16 +4763,16 @@ for (&Switch(._uuid = ls_uuid)) {
 Flow(.logical_datapath = ls_uuid,
      .stage = s_SWITCH_IN_LOOKUP_FDB(),
      .priority = 100,
-     .__match = "inport == ${sp.json_name}",
-     .actions = "$[rEGBIT_LKUP_FDB()} = lookup_fdb(inport, eth.src); next;",
+     .__match = i"inport == ${sp.json_name}",
+     .actions = i"$[rEGBIT_LKUP_FDB()} = lookup_fdb(inport, eth.src); next;",
      .stage_hint = stage_hint(lsp_uuid),
      .io_port = Some{sp.lsp.name},
      .controller_meter = None),
 Flow(.logical_datapath = ls_uuid,
      .stage = s_SWITCH_IN_LOOKUP_FDB(),
      .priority = 100,
-     .__match = "inport == ${sp.json_name} && ${rEGBIT_LKUP_FDB()} == 0",
-     .actions = "put_fdb(inport, eth.src); next;",
+     .__match = i"inport == ${sp.json_name} && ${rEGBIT_LKUP_FDB()} == 0",
+     .actions = i"put_fdb(inport, eth.src); next;",
      .stage_hint = stage_hint(lsp_uuid),
      .io_port = Some{sp.lsp.name},
      .controller_meter = None) :-
@@ -4783,16 +4783,16 @@ Flow(.logical_datapath = ls_uuid,
 Flow(.logical_datapath = ls_uuid,
      .stage            = s_SWITCH_IN_LOOKUP_FDB(),
      .priority         = 0,
-     .__match          = "1",
-     .actions          = "next;",
+     .__match          = i"1",
+     .actions          = i"next;",
      .stage_hint       = 0,
      .io_port          = None,
      .controller_meter = None),
 Flow(.logical_datapath = ls_uuid,
      .stage            = s_SWITCH_IN_PUT_FDB(),
      .priority         = 0,
-     .__match          = "1",
-     .actions          = "next;",
+     .__match          = i"1",
+     .actions          = i"next;",
      .stage_hint       = 0,
      .io_port          = None,
      .controller_meter = None) :-
@@ -4811,7 +4811,7 @@ Flow(.logical_datapath = sw._uuid,
      .stage            = s_SWITCH_OUT_PORT_SEC_L2(),
      .priority         = 50,
      .__match          = __match,
-     .actions          = queue_action ++ "output;",
+     .actions          = i"${queue_action}output;",
      .stage_hint       = stage_hint(lsp._uuid),
      .io_port          = Some{lsp.name},
      .controller_meter = None) :-
@@ -4819,9 +4819,9 @@ Flow(.logical_datapath = sw._uuid,
     lsp.is_enabled(),
     lsp.__type != "external",
     var __match = if (ps_eth_addresses.is_empty()) {
-            "outport == ${json_name}"
+            i"outport == ${json_name}"
         } else {
-            "outport == ${json_name} && eth.dst == {${ps_eth_addresses.join(\" \")}}"
+            i"outport == ${json_name} && eth.dst == {${ps_eth_addresses.join(\" \")}}"
         },
     pbinding in sb::Out_Port_Binding(.logical_port = lsp.name),
     var queue_action = match ((lsp.__type,
@@ -4835,8 +4835,8 @@ for (&SwitchPort(.lsp = lsp, .json_name = json_name, .sw = sw)) {
         Flow(.logical_datapath = sw._uuid,
              .stage            = s_SWITCH_OUT_PORT_SEC_L2(),
              .priority         = 150,
-             .__match          = "outport == {$json_name}",
-             .actions          = "drop;",
+             .__match          = i"outport == {$json_name}",
+             .actions          = i"drop;",
              .stage_hint       = stage_hint(lsp._uuid),
              .io_port          = Some{lsp.name},
              .controller_meter = None)
@@ -4870,8 +4870,8 @@ for (SwitchPortPSAddresses(.port = &SwitchPort{.lsp = lsp, .json_name = json_nam
         Flow(.logical_datapath = sw._uuid,
              .stage            = s_SWITCH_OUT_PORT_SEC_IP(),
              .priority         = 90,
-             .__match          = __match,
-             .actions          = "next;",
+             .__match          = __match.intern(),
+             .actions          = i"next;",
              .stage_hint       = stage_hint(lsp._uuid),
              .io_port          = Some{lsp.name},
              .controller_meter = None)
@@ -4882,18 +4882,18 @@ for (SwitchPortPSAddresses(.port = &SwitchPort{.lsp = lsp, .json_name = json_nam
         Flow(.logical_datapath = sw._uuid,
              .stage            = s_SWITCH_OUT_PORT_SEC_IP(),
              .priority         = 90,
-             .__match          = __match,
-             .actions          = "next;",
+             .__match          = __match.intern(),
+             .actions          = i"next;",
              .stage_hint       = stage_hint(lsp._uuid),
              .io_port          = Some{lsp.name},
              .controller_meter = None)
     };
-    var __match = "outport == ${json_name} && eth.dst == ${ps.ea} && ip" in
+    var __match = i"outport == ${json_name} && eth.dst == ${ps.ea} && ip" in
     Flow(.logical_datapath = sw._uuid,
          .stage            = s_SWITCH_OUT_PORT_SEC_IP(),
          .priority         = 80,
          .__match          = __match,
-         .actions          = "drop;",
+         .actions          = i"drop;",
          .stage_hint       = stage_hint(lsp._uuid),
          .io_port          = Some{lsp.name},
          .controller_meter = None)
@@ -4906,8 +4906,8 @@ for (&Router(._uuid = lr_uuid)) {
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_ADMISSION(),
          .priority         = 100,
-         .__match          = "vlan.present || eth.src[40]",
-         .actions          = "drop;",
+         .__match          = i"vlan.present || eth.src[40]",
+         .actions          = i"drop;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None)
@@ -4943,8 +4943,8 @@ for (&RouterPort(.lrp = lrp,
         Flow(.logical_datapath = router._uuid,
              .stage            = s_ROUTER_IN_ADMISSION(),
              .priority         = 50,
-             .__match          = "eth.mcast && inport == ${json_name}",
-             .actions          = actions,
+             .__match          = i"eth.mcast && inport == ${json_name}",
+             .actions          = actions.intern(),
              .stage_hint       = stage_hint(lrp._uuid),
              .io_port          = None,
              .controller_meter = None);
@@ -4959,8 +4959,8 @@ for (&RouterPort(.lrp = lrp,
         Flow(.logical_datapath = router._uuid,
              .stage            = s_ROUTER_IN_ADMISSION(),
              .priority         = 50,
-             .__match          = __match,
-             .actions          = actions,
+             .__match          = __match.intern(),
+             .actions          = actions.intern(),
              .stage_hint       = stage_hint(lrp._uuid),
              .io_port          = None,
              .controller_meter = None)
@@ -5014,34 +5014,34 @@ var rLNIR = rEGBIT_LOOKUP_NEIGHBOR_IP_RESULT() in
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_LOOKUP_NEIGHBOR(),
          .priority         = 100,
-         .__match          = "arp.op == 2",
+         .__match          = i"arp.op == 2",
          .actions          =
-             "${rLNR} = lookup_arp(inport, arp.spa, arp.sha); " ++
-             { if (learn_from_arp_request) "" else "${rLNIR} = 1; " } ++
-             "next;",
+             ("${rLNR} = lookup_arp(inport, arp.spa, arp.sha); " ++
+              { if (learn_from_arp_request) "" else "${rLNIR} = 1; " } ++
+              "next;").intern(),
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_LOOKUP_NEIGHBOR(),
          .priority         = 100,
-         .__match          = "nd_na",
+         .__match          = i"nd_na",
          .actions          =
-             "${rLNR} = lookup_nd(inport, nd.target, nd.tll); " ++
-             { if (learn_from_arp_request) "" else "${rLNIR} = 1; " } ++
-             "next;",
+             ("${rLNR} = lookup_nd(inport, nd.target, nd.tll); " ++
+              { if (learn_from_arp_request) "" else "${rLNIR} = 1; " } ++
+              "next;").intern(),
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_LOOKUP_NEIGHBOR(),
          .priority         = 100,
-         .__match          = "nd_ns",
+         .__match          = i"nd_ns",
          .actions          =
-             "${rLNR} = lookup_nd(inport, ip6.src, nd.sll); " ++
-             { if (learn_from_arp_request) "" else
-               "${rLNIR} = lookup_nd_ip(inport, ip6.src); " } ++
-             "next;",
+             ("${rLNR} = lookup_nd(inport, ip6.src, nd.sll); " ++
+              { if (learn_from_arp_request) "" else
+                "${rLNIR} = lookup_nd_ip(inport, ip6.src); " } ++
+              "next;").intern(),
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
@@ -5051,8 +5051,8 @@ var rLNIR = rEGBIT_LOOKUP_NEIGHBOR_IP_RESULT() in
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_LOOKUP_NEIGHBOR(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "${rLNR} = 1; next;",
+         .__match          = i"1",
+         .actions          = i"${rLNR} = 1; next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
@@ -5063,33 +5063,33 @@ var rLNIR = rEGBIT_LOOKUP_NEIGHBOR_IP_RESULT() in
          .stage            = s_ROUTER_IN_LEARN_NEIGHBOR(),
          .priority         = 100,
          .__match          =
-             "${rLNR} == 1" ++
-             { if (learn_from_arp_request) "" else " || ${rLNIR} == 0" },
-         .actions          = "next;",
+             ("${rLNR} == 1" ++
+              { if (learn_from_arp_request) "" else " || ${rLNIR} == 0" }).intern(),
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_LEARN_NEIGHBOR(),
          .priority         = 90,
-         .__match          = "arp",
-         .actions          = "put_arp(inport, arp.spa, arp.sha); next;",
+         .__match          = i"arp",
+         .actions          = i"put_arp(inport, arp.spa, arp.sha); next;",
          .io_port          = None,
          .controller_meter = copp.get(cOPP_ARP()),
          .stage_hint       = 0);
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_LEARN_NEIGHBOR(),
          .priority         = 90,
-         .__match          = "nd_na",
-         .actions          = "put_nd(inport, nd.target, nd.tll); next;",
+         .__match          = i"nd_na",
+         .actions          = i"put_nd(inport, nd.target, nd.tll); next;",
          .io_port          = None,
          .controller_meter = copp.get(cOPP_ND_NA()),
          .stage_hint       = 0);
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_LEARN_NEIGHBOR(),
          .priority         = 90,
-         .__match          = "nd_ns",
-         .actions          = "put_nd(inport, ip6.src, nd.sll); next;",
+         .__match          = i"nd_ns",
+         .actions          = i"put_nd(inport, ip6.src, nd.sll); next;",
          .io_port          = None,
          .controller_meter = copp.get(cOPP_ND_NS()),
          .stage_hint       = 0)
@@ -5112,13 +5112,13 @@ for (RouterPortNetworksIPv4Addr(rp@&RouterPort{.router = router}, addr)) {
              * so add a priority-110 flow to set
              * REGBIT_LOOKUP_NEIGHBOR_IP_RESULT to 1. */
             var __match = [match0, "arp.tpa == ${addr.addr}", match1] in
-            var actions = "${rLNR} = lookup_arp(inport, arp.spa, arp.sha); "
+            var actions = i"${rLNR} = lookup_arp(inport, arp.spa, arp.sha); "
                           "${rLNIR} = 1; "
                           "next;" in
             Flow(.logical_datapath = router._uuid,
                  .stage            = s_ROUTER_IN_LOOKUP_NEIGHBOR(),
                  .priority         = 110,
-                 .__match          = __match.join(" && "),
+                 .__match          = __match.join(" && ").intern(),
                  .actions          = actions,
                  .stage_hint       = stage_hint(rp.lrp._uuid),
                  .io_port          = None,
@@ -5132,8 +5132,8 @@ for (RouterPortNetworksIPv4Addr(rp@&RouterPort{.router = router}, addr)) {
         Flow(.logical_datapath = router._uuid,
              .stage            = s_ROUTER_IN_LOOKUP_NEIGHBOR(),
              .priority         = 100,
-             .__match          = "${match0} && ${match1}",
-             .actions          = actions,
+             .__match          = i"${match0} && ${match1}",
+             .actions          = actions.intern(),
              .stage_hint       = stage_hint(rp.lrp._uuid),
              .io_port          = None,
              .controller_meter = None)
@@ -5149,13 +5149,13 @@ for (router in &Router(._uuid = lr_uuid, .mcast_cfg = mcast_cfg)) {
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_IP_INPUT(),
          .priority         = 100,
-         .__match          = "ip4.src_mcast ||"
+         .__match          = i"ip4.src_mcast ||"
          "ip4.src == 255.255.255.255 || "
          "ip4.src == 127.0.0.0/8 || "
          "ip4.dst == 127.0.0.0/8 || "
          "ip4.src == 0.0.0.0/8 || "
          "ip4.dst == 0.0.0.0/8",
-         .actions          = "drop;",
+         .actions          = i"drop;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
@@ -5168,8 +5168,8 @@ for (router in &Router(._uuid = lr_uuid, .mcast_cfg = mcast_cfg)) {
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_IP_INPUT(),
          .priority         = 85,
-         .__match          = "arp || nd",
-         .actions          = "drop;",
+         .__match          = i"arp || nd",
+         .actions          = i"drop;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
@@ -5180,8 +5180,8 @@ for (router in &Router(._uuid = lr_uuid, .mcast_cfg = mcast_cfg)) {
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_IP_INPUT(),
          .priority         = 84,
-         .__match          = "nd_rs || nd_ra",
-         .actions          = "next;",
+         .__match          = i"nd_rs || nd_ra",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
@@ -5190,18 +5190,18 @@ for (router in &Router(._uuid = lr_uuid, .mcast_cfg = mcast_cfg)) {
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_IP_INPUT(),
          .priority         = 83,
-         .__match          = "ip6.mcast_rsvd",
-         .actions          = "drop;",
+         .__match          = i"ip6.mcast_rsvd",
+         .actions          = i"drop;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
 
     /* Allow other multicast if relay enabled (priority 82). */
-    var mcast_action = { if (mcast_cfg.relay) { "next;" } else { "drop;" } } in
+    var mcast_action = { if (mcast_cfg.relay) { i"next;" } else { i"drop;" } } in
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_IP_INPUT(),
          .priority         = 82,
-         .__match          = "ip4.mcast || ip6.mcast",
+         .__match          = i"ip4.mcast || ip6.mcast",
          .actions          = mcast_action,
          .stage_hint       = 0,
          .io_port          = None,
@@ -5212,8 +5212,8 @@ for (router in &Router(._uuid = lr_uuid, .mcast_cfg = mcast_cfg)) {
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_IP_INPUT(),
          .priority         = 50,
-         .__match          = "eth.bcast",
-         .actions          = "drop;",
+         .__match          = i"eth.bcast",
+         .actions          = i"drop;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
@@ -5223,8 +5223,8 @@ for (router in &Router(._uuid = lr_uuid, .mcast_cfg = mcast_cfg)) {
         .logical_datapath = lr_uuid,
         .stage            = s_ROUTER_IN_IP_INPUT(),
         .priority         = 30,
-        .__match          = "ip4 && ip.ttl == {0, 1}",
-        .actions          = "drop;",
+        .__match          = i"ip4 && ip.ttl == {0, 1}",
+        .actions          = i"drop;",
         .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
@@ -5234,8 +5234,8 @@ for (router in &Router(._uuid = lr_uuid, .mcast_cfg = mcast_cfg)) {
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_IP_INPUT(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None)
@@ -5323,8 +5323,8 @@ for (&RouterPort(.router = router, .networks = networks, .lrp = lrp)
     Flow(.logical_datapath = router._uuid,
          .stage            = s_ROUTER_IN_IP_INPUT(),
          .priority         = 100,
-         .__match          = __match,
-         .actions          = "drop;",
+         .__match          = __match.intern(),
+         .actions          = i"drop;",
          .stage_hint       = stage_hint(lrp._uuid),
          .io_port          = None,
          .controller_meter = None);
@@ -5340,8 +5340,8 @@ for (&RouterPort(.router = router, .networks = networks, .lrp = lrp)
     Flow(.logical_datapath = router._uuid,
          .stage            = s_ROUTER_IN_IP_INPUT(),
          .priority         = 90,
-         .__match          = __match,
-         .actions          = "ip4.dst <-> ip4.src; "
+         .__match          = __match.intern(),
+         .actions          = i"ip4.dst <-> ip4.src; "
                              "ip.ttl = 255; "
                              "icmp4.type = 0; "
                              "flags.loopback = 1; "
@@ -5464,7 +5464,7 @@ relation LogicalRouterArpFlow(
 Flow(.logical_datapath = lr._uuid,
      .stage = s_ROUTER_IN_IP_INPUT(),
      .priority = priority,
-     .__match = __match,
+     .__match = __match.intern(),
      .actions = actions,
      .stage_hint = stage_hint,
      .io_port          = None,
@@ -5483,9 +5483,9 @@ Flow(.logical_datapath = lr._uuid,
         clauses.join(" && ")
     },
     var actions = if (drop) {
-       "drop;"
+       i"drop;"
     } else {
-        "eth.dst = eth.src; "
+        i"eth.dst = eth.src; "
         "eth.src = ${mac}; "
         "arp.op = 2; /* ARP reply */ "
         "arp.tha = arp.sha; "
@@ -5510,7 +5510,7 @@ relation LogicalRouterNdFlow(
 Flow(.logical_datapath = lr._uuid,
      .stage = s_ROUTER_IN_IP_INPUT(),
      .priority = priority,
-     .__match = __match,
+     .__match = __match.intern(),
      .actions = actions,
      .io_port = None,
      .controller_meter = controller_meter,
@@ -5533,9 +5533,9 @@ Flow(.logical_datapath = lr._uuid,
         clauses.join(" && ")
     },
     (var actions, var controller_meter) = if (drop) {
-        ("drop;", None)
+        (i"drop;", None)
     } else {
-        ("${action} { "
+        (i"${action} { "
            "eth.src = ${mac}; "
            "ip6.src = ${ip}; "
            "nd.target = ${ip}; "
@@ -5558,9 +5558,9 @@ for (RouterPortNetworksIPv4Addr(.port = &RouterPort{.lrp = lrp,
     Flow(.logical_datapath = router._uuid,
          .stage            = s_ROUTER_IN_IP_INPUT(),
          .priority         = 40,
-         .__match          = "inport == ${json_name} && ip4 && "
+         .__match          = i"inport == ${json_name} && ip4 && "
                              "ip.ttl == {0, 1} && !ip.later_frag",
-         .actions          = "icmp4 {"
+         .actions          = i"icmp4 {"
                              "eth.dst <-> eth.src; "
                              "icmp4.type = 11; /* Time exceeded */ "
                              "icmp4.code = 0; /* TTL exceeded in transit */ "
@@ -5646,8 +5646,8 @@ var residence_check = match (is_redirect) {
 Flow(.logical_datapath = lr_uuid,
      .stage = s_ROUTER_IN_IP_INPUT(),
      .priority = 60,
-     .__match = "ip4.dst == {" ++ match_ips.join(", ") ++ "}",
-     .actions = "drop;",
+     .__match = ("ip4.dst == {" ++ match_ips.join(", ") ++ "}").intern(),
+     .actions = i"drop;",
      .stage_hint = stage_hint(lrp_uuid),
      .io_port          = None,
      .controller_meter = None) :-
@@ -5662,8 +5662,8 @@ Flow(.logical_datapath = lr_uuid,
 Flow(.logical_datapath = lr_uuid,
      .stage = s_ROUTER_IN_IP_INPUT(),
      .priority = 60,
-     .__match = "ip6.dst == {" ++ match_ips.join(", ") ++ "}",
-     .actions = "drop;",
+     .__match = ("ip6.dst == {" ++ match_ips.join(", ") ++ "}").intern(),
+     .actions = i"drop;",
      .stage_hint = stage_hint(lrp_uuid),
      .io_port          = None,
      .controller_meter = None) :-
@@ -5686,12 +5686,12 @@ for (RouterPortNetworksIPv4Addr(
          .addr = addr))
 {
     /* UDP/TCP/SCTP port unreachable. */
-    var __match = "ip4 && ip4.dst == ${addr.addr} && !ip.later_frag && udp" in
+    var __match = i"ip4 && ip4.dst == ${addr.addr} && !ip.later_frag && udp" in
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_IP_INPUT(),
          .priority         = 80,
          .__match          = __match,
-         .actions          = "icmp4 {"
+         .actions          = i"icmp4 {"
                              "eth.dst <-> eth.src; "
                              "ip4.dst <-> ip4.src; "
                              "ip.ttl = 255; "
@@ -5702,12 +5702,12 @@ for (RouterPortNetworksIPv4Addr(
          .controller_meter = copp.get(cOPP_ICMP4_ERR()),
          .stage_hint       = stage_hint(lrp._uuid));
 
-    var __match = "ip4 && ip4.dst == ${addr.addr} && !ip.later_frag && tcp" in
+    var __match = i"ip4 && ip4.dst == ${addr.addr} && !ip.later_frag && tcp" in
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_IP_INPUT(),
          .priority         = 80,
          .__match          = __match,
-         .actions          = "tcp_reset {"
+         .actions          = i"tcp_reset {"
                              "eth.dst <-> eth.src; "
                              "ip4.dst <-> ip4.src; "
                              "next; };",
@@ -5715,12 +5715,12 @@ for (RouterPortNetworksIPv4Addr(
          .controller_meter = copp.get(cOPP_TCP_RESET()),
          .stage_hint       = stage_hint(lrp._uuid));
 
-    var __match = "ip4 && ip4.dst == ${addr.addr} && !ip.later_frag && sctp" in
+    var __match = i"ip4 && ip4.dst == ${addr.addr} && !ip.later_frag && sctp" in
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_IP_INPUT(),
          .priority         = 80,
          .__match          = __match,
-         .actions          = "sctp_abort {"
+         .actions          = i"sctp_abort {"
                              "eth.dst <-> eth.src; "
                              "ip4.dst <-> ip4.src; "
                              "next; };",
@@ -5728,12 +5728,12 @@ for (RouterPortNetworksIPv4Addr(
          .controller_meter = copp.get(cOPP_TCP_RESET()),
          .stage_hint       = stage_hint(lrp._uuid));
 
-    var __match = "ip4 && ip4.dst == ${addr.addr} && !ip.later_frag" in
+    var __match = i"ip4 && ip4.dst == ${addr.addr} && !ip.later_frag" in
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_IP_INPUT(),
          .priority         = 70,
          .__match          = __match,
-         .actions          = "icmp4 {"
+         .actions          = i"icmp4 {"
                              "eth.dst <-> eth.src; "
                              "ip4.dst <-> ip4.src; "
                              "ip.ttl = 255; "
@@ -5749,9 +5749,9 @@ for (RouterPortNetworksIPv4Addr(
 Flow(.logical_datapath = rp.router._uuid,
      .stage            = s_ROUTER_IN_IP_INPUT(),
      .priority         = 100,
-     .__match          = "ip6.dst == ${ipv6_addr.addr} "
+     .__match          = i"ip6.dst == ${ipv6_addr.addr} "
                          "&& udp.src == 547 && udp.dst == 546",
-     .actions          = "reg0 = 0; handle_dhcpv6_reply;",
+     .actions          = i"reg0 = 0; handle_dhcpv6_reply;",
      .stage_hint       = stage_hint(rp.lrp._uuid),
      .io_port          = None,
      .controller_meter = None) :-
@@ -5776,8 +5776,8 @@ for (&RouterPort(.router = router, .networks = networks, .lrp = lrp)
     Flow(.logical_datapath = router._uuid,
          .stage            = s_ROUTER_IN_IP_INPUT(),
          .priority         = 90,
-         .__match          = __match,
-         .actions          = "ip6.dst <-> ip6.src; "
+         .__match          = __match.intern(),
+         .actions          = i"ip6.dst <-> ip6.src; "
          "ip.ttl = 255; "
          "icmp6.type = 129; "
          "flags.loopback = 1; "
@@ -5826,12 +5826,12 @@ for (RouterPortNetworksIPv6Addr(
                             .json_name = json_name},
         .addr = addr))
 {
-    var __match = "ip6 && ip6.dst == ${addr.addr} && !ip.later_frag && tcp" in
+    var __match = i"ip6 && ip6.dst == ${addr.addr} && !ip.later_frag && tcp" in
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_IP_INPUT(),
          .priority         = 80,
          .__match          = __match,
-         .actions          = "tcp_reset {"
+         .actions          = i"tcp_reset {"
                              "eth.dst <-> eth.src; "
                              "ip6.dst <-> ip6.src; "
                              "next; };",
@@ -5839,12 +5839,12 @@ for (RouterPortNetworksIPv6Addr(
          .controller_meter = copp.get(cOPP_TCP_RESET()),
          .stage_hint       = stage_hint(lrp._uuid));
 
-    var __match = "ip6 && ip6.dst == ${addr.addr} && !ip.later_frag && sctp" in
+    var __match = i"ip6 && ip6.dst == ${addr.addr} && !ip.later_frag && sctp" in
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_IP_INPUT(),
          .priority         = 80,
          .__match          = __match,
-         .actions          = "sctp_abort {"
+         .actions          = i"sctp_abort {"
                              "eth.dst <-> eth.src; "
                              "ip6.dst <-> ip6.src; "
                              "next; };",
@@ -5852,12 +5852,12 @@ for (RouterPortNetworksIPv6Addr(
          .controller_meter = copp.get(cOPP_TCP_RESET()),
          .stage_hint       = stage_hint(lrp._uuid));
 
-    var __match = "ip6 && ip6.dst == ${addr.addr} && !ip.later_frag && udp" in
+    var __match = i"ip6 && ip6.dst == ${addr.addr} && !ip.later_frag && udp" in
     Flow(.logical_datapath = lr_uuid,
         .stage            = s_ROUTER_IN_IP_INPUT(),
         .priority         = 80,
         .__match          = __match,
-        .actions          = "icmp6 {"
+        .actions          = i"icmp6 {"
                             "eth.dst <-> eth.src; "
                             "ip6.dst <-> ip6.src; "
                             "ip.ttl = 255; "
@@ -5868,12 +5868,12 @@ for (RouterPortNetworksIPv6Addr(
         .controller_meter = copp.get(cOPP_ICMP6_ERR()),
         .stage_hint       = stage_hint(lrp._uuid));
 
-    var __match = "ip6 && ip6.dst == ${addr.addr} && !ip.later_frag" in
+    var __match = i"ip6 && ip6.dst == ${addr.addr} && !ip.later_frag" in
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_IP_INPUT(),
          .priority         = 70,
          .__match          = __match,
-         .actions          = "icmp6 {"
+         .actions          = i"icmp6 {"
                              "eth.dst <-> eth.src; "
                              "ip6.dst <-> ip6.src; "
                              "ip.ttl = 255; "
@@ -5893,10 +5893,10 @@ for (RouterPortNetworksIPv6Addr(.port = &RouterPort{.router = router,
      /* skip link-local address */
      if (not addr.is_lla()))
 {
-    var __match = "inport == ${json_name} && ip6 && "
+    var __match = i"inport == ${json_name} && ip6 && "
                   "ip6.src == ${addr.match_network()} && "
                   "ip.ttl == {0, 1} && !ip.later_frag" in
-    var actions = "icmp6 {"
+    var actions = i"icmp6 {"
                   "eth.dst <-> eth.src; "
                   "ip6.dst = ip6.src; "
                   "ip6.src = ${addr.addr}; "
@@ -5920,8 +5920,8 @@ function default_allow_flow(datapath: uuid, stage: Intern<Stage>): Flow {
     Flow{.logical_datapath = datapath,
          .stage            = stage,
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .io_port          = None,
          .controller_meter = None,
          .stage_hint       = 0}
@@ -5943,8 +5943,8 @@ for (r in &Router(._uuid = lr_uuid)) {
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_OUT_SNAT(),
          .priority         = 120,
-         .__match          = "nd_ns",
-         .actions          = "next;",
+         .__match          = i"nd_ns",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None)
@@ -5968,8 +5968,8 @@ for (r in &Router(._uuid = lr_uuid,
     Flow(.logical_datapath = lr_uuid,
         .stage            = s_ROUTER_OUT_POST_UNDNAT(),
         .priority         = 50,
-        .__match          = "ip && ct.new",
-        .actions          = "ct_commit { } ; next; ",
+        .__match          = i"ip && ct.new",
+        .actions          = i"ct_commit { } ; next; ",
         .stage_hint       = 0,
         .io_port          = None,
         .controller_meter = None);
@@ -5977,8 +5977,8 @@ for (r in &Router(._uuid = lr_uuid,
     Flow(.logical_datapath = lr_uuid,
         .stage            = s_ROUTER_OUT_UNDNAT(),
         .priority         = 50,
-        .__match          = "ip",
-        .actions          = "flags.loopback = 1; ct_dnat;",
+        .__match          = i"ip",
+        .actions          = i"flags.loopback = 1; ct_dnat;",
         .stage_hint       = 0,
         .io_port          = None,
         .controller_meter = None)
@@ -5987,8 +5987,8 @@ for (r in &Router(._uuid = lr_uuid,
 Flow(.logical_datapath = lr,
      .stage            = s_ROUTER_OUT_SNAT(),
      .priority         = 120,
-     .__match          = "flags.skip_snat_for_lb == 1 && ip",
-     .actions          = "next;",
+     .__match          = i"flags.skip_snat_for_lb == 1 && ip",
+     .actions          = i"next;",
      .stage_hint       = stage_hint(lb._uuid),
      .io_port          = None,
      .controller_meter = None) :-
@@ -6054,8 +6054,8 @@ function lrouter_nat_add_ext_ip_match(
              Some{Flow{.logical_datapath = router._uuid,
                        .stage = if (is_src) { s_ROUTER_IN_DNAT() } else { s_ROUTER_OUT_SNAT() },
                        .priority = priority,
-                       .__match = "${__match} && ${ipX}.${dir} == $${__as.name}",
-                       .actions = "next;",
+                       .__match = i"${__match} && ${ipX}.${dir} == $${__as.name}",
+                       .actions = i"next;",
                        .stage_hint = stage_hint(nat.nat._uuid),
                        .io_port = None,
                        .controller_meter = None}})
@@ -6070,8 +6070,8 @@ relation LogicalRouterForceSnatFlows(
 Flow(.logical_datapath = logical_router,
      .stage = s_ROUTER_IN_UNSNAT(),
      .priority = 110,
-     .__match = "${ipX} && ${ipX}.dst == ${ip}",
-     .actions = "ct_snat;",
+     .__match = i"${ipX} && ${ipX}.dst == ${ip}",
+     .actions = i"ct_snat;",
      .stage_hint = 0,
      .io_port          = None,
      .controller_meter = None),
@@ -6081,8 +6081,8 @@ Flow(.logical_datapath = logical_router,
 Flow(.logical_datapath = logical_router,
      .stage = s_ROUTER_OUT_SNAT(),
      .priority = 100,
-     .__match = "flags.force_snat_for_${context} == 1 && ${ipX}",
-     .actions = "ct_snat(${ip});",
+     .__match = i"flags.force_snat_for_${context} == 1 && ${ipX}",
+     .actions = i"ct_snat(${ip});",
      .stage_hint = 0,
      .io_port = None,
      .controller_meter = None) :-
@@ -6101,8 +6101,8 @@ for (rp in &RouterPort(.router = &Router{._uuid = lr_uuid, .options = lr_options
             Flow(.logical_datapath = lr_uuid,
                  .stage = s_ROUTER_IN_UNSNAT(),
                  .priority = 110,
-                 .__match = "inport == ${rp.json_name} && ip4.dst == ${ipv4.addr}",
-                 .actions = "ct_snat;",
+                 .__match = i"inport == ${rp.json_name} && ip4.dst == ${ipv4.addr}",
+                 .actions = i"ct_snat;",
                  .stage_hint = 0,
                  .io_port = None,
                  .controller_meter = None);
@@ -6110,8 +6110,8 @@ for (rp in &RouterPort(.router = &Router{._uuid = lr_uuid, .options = lr_options
             Flow(.logical_datapath = lr_uuid,
                  .stage = s_ROUTER_OUT_SNAT(),
                  .priority = 110,
-                 .__match = "flags.force_snat_for_lb == 1 && ip4 && outport == ${rp.json_name}",
-                 .actions = "ct_snat(${ipv4.addr});",
+                 .__match = i"flags.force_snat_for_lb == 1 && ip4 && outport == ${rp.json_name}",
+                 .actions = i"ct_snat(${ipv4.addr});",
                  .stage_hint = 0,
                  .io_port = None,
                  .controller_meter = None);
@@ -6130,8 +6130,8 @@ for (rp in &RouterPort(.router = &Router{._uuid = lr_uuid, .options = lr_options
                 Flow(.logical_datapath = lr_uuid,
                      .stage = s_ROUTER_IN_UNSNAT(),
                      .priority = 110,
-                     .__match = "inport == ${rp.json_name} && ip6.dst == ${ipv6.addr}",
-                     .actions = "ct_snat;",
+                     .__match = i"inport == ${rp.json_name} && ip6.dst == ${ipv6.addr}",
+                     .actions = i"ct_snat;",
                      .stage_hint = 0,
                      .io_port = None,
                      .controller_meter = None);
@@ -6139,8 +6139,8 @@ for (rp in &RouterPort(.router = &Router{._uuid = lr_uuid, .options = lr_options
                 Flow(.logical_datapath = lr_uuid,
                      .stage = s_ROUTER_OUT_SNAT(),
                      .priority = 110,
-                     .__match = "flags.force_snat_for_lb == 1 && ip6 && outport == ${rp.json_name}",
-                     .actions = "ct_snat(${ipv6.addr});",
+                     .__match = i"flags.force_snat_for_lb == 1 && ip6 && outport == ${rp.json_name}",
+                     .actions = i"ct_snat(${ipv6.addr});",
                      .stage_hint = 0,
                      .io_port = None,
                      .controller_meter = None);
@@ -6204,14 +6204,14 @@ for (r in &Router(._uuid = lr_uuid,
                 if (l3dgw_ports.is_empty()) {
                     /* Gateway router. */
                     var actions = if (stateless) {
-                        "${ipX}.dst=${nat.nat.logical_ip}; next;"
+                        i"${ipX}.dst=${nat.nat.logical_ip}; next;"
                     } else {
-                        "ct_snat;"
+                        i"ct_snat;"
                     } in
                     Flow(.logical_datapath = lr_uuid,
                          .stage            = s_ROUTER_IN_UNSNAT(),
                          .priority         = 90,
-                         .__match          = "ip && ${ipX}.dst == ${nat.nat.external_ip}",
+                         .__match          = i"ip && ${ipX}.dst == ${nat.nat.external_ip}",
                          .actions          = actions,
                          .stage_hint       = stage_hint(nat.nat._uuid),
                          .io_port          = None,
@@ -6230,14 +6230,14 @@ for (r in &Router(._uuid = lr_uuid,
                             " && is_chassis_resident(${json_string_escape(chassis_redirect_name(gwport.name))})"
                         } else { "" } in
                     var actions = if (stateless) {
-                        "${ipX}.dst=${nat.nat.logical_ip}; next;"
+                        i"${ipX}.dst=${nat.nat.logical_ip}; next;"
                     } else {
-                        "ct_snat;"
+                        i"ct_snat;"
                     } in
                     Flow(.logical_datapath = lr_uuid,
                          .stage            = s_ROUTER_IN_UNSNAT(),
                          .priority         = 100,
-                         .__match          = __match,
+                         .__match          = __match.intern(),
                          .actions          = actions,
                          .stage_hint       = stage_hint(nat.nat._uuid),
                          .io_port          = None,
@@ -6282,8 +6282,8 @@ for (r in &Router(._uuid = lr_uuid,
                     Flow(.logical_datapath = lr_uuid,
                          .stage            = s_ROUTER_IN_DNAT(),
                          .priority         = 100,
-                         .__match          = __match ++ ext_ip_match,
-                         .actions          = flag_action ++ nat_actions,
+                         .__match          = (__match ++ ext_ip_match).intern(),
+                         .actions          = (flag_action ++ nat_actions).intern(),
                          .stage_hint       = stage_hint(nat.nat._uuid),
                          .io_port          = None,
                          .controller_meter = None)
@@ -6306,14 +6306,14 @@ for (r in &Router(._uuid = lr_uuid,
                     Some{var f} = ext_flow in Flow[f];
 
                     var actions = if (stateless) {
-                        "${ipX}.dst=${nat.nat.logical_ip}; next;"
+                        i"${ipX}.dst=${nat.nat.logical_ip}; next;"
                     } else {
-                        "ct_dnat(${ip_and_ports});"
+                        i"ct_dnat(${ip_and_ports});"
                     } in
                     Flow(.logical_datapath = lr_uuid,
                          .stage            = s_ROUTER_IN_DNAT(),
                          .priority         = 100,
-                         .__match          = __match ++ ext_ip_match,
+                         .__match          = (__match ++ ext_ip_match).intern(),
                          .actions          = actions,
                          .stage_hint       = stage_hint(nat.nat._uuid),
                          .io_port          = None,
@@ -6325,20 +6325,20 @@ for (r in &Router(._uuid = lr_uuid,
             Some {var gwport} = l3dgw_ports.nth(0) in {
             var gwport_name = json_string_escape(gwport.name) in {
                 if (nat.nat.__type == "snat") {
-                    var __match = "inport == ${gwport_name} && "
+                    var __match = i"inport == ${gwport_name} && "
                                   "${ipX}.src == ${nat.nat.external_ip}" in
                     Flow(.logical_datapath = lr_uuid,
                          .stage            = s_ROUTER_IN_IP_INPUT(),
                          .priority         = 120,
                          .__match          = __match,
-                         .actions          = "next;",
+                         .actions          = i"next;",
                          .stage_hint       = stage_hint(nat.nat._uuid),
                          .io_port          = None,
                          .controller_meter = None)
                 };
 
                 var nexthop_reg = "${xx}${rEG_NEXT_HOP()}" in
-                var __match = "outport == ${gwport_name} && "
+                var __match = i"outport == ${gwport_name} && "
                               "${nexthop_reg} == ${nat.nat.external_ip}" in
                 var dst_mac = match (mac) {
                     Some{value} -> "${value}",
@@ -6348,7 +6348,7 @@ for (r in &Router(._uuid = lr_uuid,
                      .stage            = s_ROUTER_IN_ARP_RESOLVE(),
                      .priority         = 100,
                      .__match          = __match,
-                     .actions          = "eth.dst = ${dst_mac}; next;",
+                     .actions          = i"eth.dst = ${dst_mac}; next;",
                      .stage_hint       = stage_hint(nat.nat._uuid),
                      .io_port          = None,
                      .controller_meter = None)
@@ -6385,8 +6385,8 @@ for (r in &Router(._uuid = lr_uuid,
                 Flow(.logical_datapath = lr_uuid,
                      .stage            = s_ROUTER_OUT_UNDNAT(),
                      .priority         = 100,
-                     .__match          = __match,
-                     .actions          = actions,
+                     .__match          = __match.intern(),
+                     .actions          = actions.intern(),
                      .stage_hint       = stage_hint(nat.nat._uuid),
                      .io_port          = None,
                      .controller_meter = None)
@@ -6414,15 +6414,15 @@ for (r in &Router(._uuid = lr_uuid,
                      * nat->logical_ip with the longest mask gets a higher
                      * priority. */
                     var actions = if (stateless) {
-                        "${ipX}.src=${nat.nat.external_ip}; next;"
+                        i"${ipX}.src=${nat.nat.external_ip}; next;"
                     } else {
-                        "ct_snat(${ip_and_ports});"
+                        i"ct_snat(${ip_and_ports});"
                     } in
                     Some{var plen} = mask.cidr_bits() in
                     Flow(.logical_datapath = lr_uuid,
                          .stage            = s_ROUTER_OUT_SNAT(),
                          .priority         = plen as bit<64> + 1,
-                         .__match          = __match ++ ext_ip_match,
+                         .__match          = (__match ++ ext_ip_match).intern(),
                          .actions          = actions,
                          .stage_hint       = stage_hint(nat.nat._uuid),
                          .io_port          = None,
@@ -6462,8 +6462,8 @@ for (r in &Router(._uuid = lr_uuid,
                     Flow(.logical_datapath = lr_uuid,
                          .stage            = s_ROUTER_OUT_SNAT(),
                          .priority         = priority + centralized_boost,
-                         .__match          = __match ++ ext_ip_match,
-                         .actions          = actions,
+                         .__match          = (__match ++ ext_ip_match).intern(),
+                         .actions          = actions.intern(),
                          .stage_hint       = stage_hint(nat.nat._uuid),
                          .io_port          = None,
                          .controller_meter = None)
@@ -6479,13 +6479,13 @@ for (r in &Router(._uuid = lr_uuid,
             Some{var gwport} = l3dgw_ports.nth(0) in
             Some{var logical_port} = nat.nat.logical_port in
             var __match =
-                "eth.dst == ${mac_addr} && inport == ${json_string_escape(gwport.name)}"
+                i"eth.dst == ${mac_addr} && inport == ${json_string_escape(gwport.name)}"
                 " && is_chassis_resident(${json_string_escape(logical_port)})" in
             /* Store the ethernet address of the port receiving the packet.
              * This will save us from having to match on inport further
              * down in the pipeline.
              */
-            var actions = "${rEG_INPORT_ETH_ADDR()} = ${gwport.mac}; next;" in
+            var actions = i"${rEG_INPORT_ETH_ADDR()} = ${gwport.mac}; next;" in
             Flow(.logical_datapath = lr_uuid,
                  .stage            = s_ROUTER_IN_ADMISSION(),
                  .priority         = 50,
@@ -6508,11 +6508,11 @@ for (r in &Router(._uuid = lr_uuid,
             Some{var logical_port} = nat.nat.logical_port in
             Some{var external_mac} = nat.nat.external_mac in
             var __match =
-                "${ipX}.src == ${nat.nat.logical_ip} && "
+                i"${ipX}.src == ${nat.nat.logical_ip} && "
                 "outport == ${json_string_escape(gwport.name)} && "
                 "is_chassis_resident(${json_string_escape(logical_port)})" in
             var actions =
-                "eth.src = ${external_mac}; "
+                i"eth.src = ${external_mac}; "
                 "${xx}${rEG_SRC()} = ${nat.nat.external_ip}; "
                 "next;" in
             Flow(.logical_datapath = lr_uuid,
@@ -6529,9 +6529,9 @@ for (r in &Router(._uuid = lr_uuid,
                 Flow(.logical_datapath = lr_uuid,
                      .stage            = s_ROUTER_IN_GW_REDIRECT(),
                     .priority         = 80,
-                    .__match          = "${ipX}.src == ${nat.nat.logical_ip} && "
+                    .__match          = i"${ipX}.src == ${nat.nat.logical_ip} && "
                                         "outport == ${json_string_escape(gwport.name)}",
-                    .actions          = "drop;",
+                    .actions          = i"drop;",
                     .stage_hint       = stage_hint(nat.nat._uuid),
                     .io_port          = None,
                     .controller_meter = None)
@@ -6551,7 +6551,7 @@ for (r in &Router(._uuid = lr_uuid,
                            },
                 None -> Some{json_string_escape(chassis_redirect_name(gwport.name))}
             } in
-            var __match = "${ipX}.dst == ${nat.nat.external_ip} && outport == ${json_string_escape(gwport.name)} && is_chassis_resident(${port})" in
+            var __match = i"${ipX}.dst == ${nat.nat.external_ip} && outport == ${json_string_escape(gwport.name)} && is_chassis_resident(${port})" in
             var regs = {
                 var regs = vec_empty();
                 for (j in range_vec(0, mFF_N_LOG_REGS(), 01)) {
@@ -6571,7 +6571,7 @@ for (r in &Router(._uuid = lr_uuid,
                  .stage            = s_ROUTER_OUT_EGR_LOOP(),
                  .priority         = 100,
                  .__match          = __match,
-                 .actions          = actions,
+                 .actions          = actions.intern(),
                  .stage_hint       = stage_hint(nat.nat._uuid),
                  .io_port          = None,
                  .controller_meter = None)
@@ -6656,7 +6656,7 @@ for (RouterLBVIP(
             } in
         var __match = match1 ++ match2 in
         var xx = ip_address.xxreg() in
-        var __actions = "${xx}${rEG_NEXT_HOP()} = ${ip_address}; ct_dnat;" in
+        var __actions = i"${xx}${rEG_NEXT_HOP()} = ${ip_address}; ct_dnat;" in
         /* One of these flows must be created for each unique LB VIP address.
          * We create one for each VIP:port pair; flows with the same IP and
          * different port numbers will produce identical flows that will
@@ -6664,7 +6664,7 @@ for (RouterLBVIP(
         Flow(.logical_datapath = lr_uuid,
              .stage            = s_ROUTER_IN_DEFRAG(),
              .priority         = prio,
-             .__match          = __match,
+             .__match          = __match.intern(),
              .actions          = __actions,
              .stage_hint       = stage_hint(lb._uuid),
              .io_port          = None,
@@ -6703,14 +6703,14 @@ for (RouterLBVIP(
                 } in
             var actions =
                 match (snat_for_lb) {
-                    SkipSNAT -> "flags.skip_snat_for_lb = 1; next;",
-                    ForceSNAT -> "flags.force_snat_for_lb = 1; next;",
-                    _ -> "next;"
+                    SkipSNAT -> i"flags.skip_snat_for_lb = 1; next;",
+                    ForceSNAT -> i"flags.force_snat_for_lb = 1; next;",
+                    _ -> i"next;"
                 } in
             Flow(.logical_datapath = lr_uuid,
                  .stage            = s_ROUTER_IN_DNAT(),
                  .priority         = prio,
-                 .__match          = est_match,
+                 .__match          = est_match.intern(),
                  .actions          = actions,
                  .stage_hint       = stage_hint(lb._uuid),
                  .io_port          = None,
@@ -6734,8 +6734,8 @@ for (RouterLBVIP(
                 Flow(.logical_datapath = lr_uuid,
                      .stage            = s_ROUTER_IN_UNSNAT(),
                      .priority         = 120,
-                     .__match          = match3,
-                     .actions          = "next;",
+                     .__match          = match3.intern(),
+                     .actions          = i"next;",
                      .stage_hint       = stage_hint(lb._uuid),
                      .io_port          = None,
                      .controller_meter = None)
@@ -6769,14 +6769,14 @@ for (RouterLBVIP(
                 "is_chassis_resident(${json_string_escape(chassis_redirect_name(gwport.name))})" in
             var action =
                 match (snat_for_lb) {
-                    SkipSNAT -> "flags.skip_snat_for_lb = 1; ct_dnat;",
-                    ForceSNAT -> "flags.force_snat_for_lb = 1; ct_dnat;",
-                    _ -> "ct_dnat;"
+                    SkipSNAT -> i"flags.skip_snat_for_lb = 1; ct_dnat;",
+                    ForceSNAT -> i"flags.force_snat_for_lb = 1; ct_dnat;",
+                    _ -> i"ct_dnat;"
                 } in
             Flow(.logical_datapath = lr_uuid,
                  .stage            = s_ROUTER_OUT_UNDNAT(),
                  .priority         = 120,
-                 .__match          = undnat_match,
+                 .__match          = undnat_match.intern(),
                  .actions          = action,
                  .stage_hint       = stage_hint(lb._uuid),
                  .io_port          = None,
@@ -6793,8 +6793,8 @@ for (RouterLBVIP(
 Flow(.logical_datapath = r._uuid,
      .stage            = s_ROUTER_IN_DNAT(),
      .priority         = priority,
-     .__match          = __match,
-     .actions          = actions,
+     .__match          = __match.intern(),
+     .actions          = actions.intern(),
      .io_port          = None,
      .controller_meter = meter,
      .stage_hint       = stage_hint(lb._uuid)) :-
@@ -6939,7 +6939,7 @@ for (&RouterPort[port@RouterPort{.lrp = lrp@&nb::Logical_Router_Port{.peer = Non
                 (add_rs_response_flow, prefix)
             } in
         {
-            var __match = "inport == ${json_name} && ip6.dst == ff02::2 && nd_rs" in
+            var __match = i"inport == ${json_name} && ip6.dst == ff02::2 && nd_rs" in
             /* As per RFC 2460, 1280 is minimum IPv6 MTU. */
             var mtu = match(lrp.ipv6_ra_configs.get("mtu")) {
                     Some{mtu_s} -> {
@@ -6965,15 +6965,15 @@ for (&RouterPort[port@RouterPort{.lrp = lrp@&nb::Logical_Router_Port{.peer = Non
                  .stage            = s_ROUTER_IN_ND_RA_OPTIONS(),
                  .priority         = 50,
                  .__match          = __match,
-                 .actions          = actions,
+                 .actions          = actions.intern(),
                  .io_port          = None,
                  .controller_meter = router.copp.get(cOPP_ND_RA_OPTS()),
                  .stage_hint       = stage_hint(lrp._uuid));
 
-            var __match = "inport == ${json_name} && ip6.dst == ff02::2 && "
+            var __match = i"inport == ${json_name} && ip6.dst == ff02::2 && "
                           "nd_ra && ${rEGBIT_ND_RA_OPTS_RESULT()}" in
             var ip6_str = networks.ea.to_ipv6_lla().string_mapped() in
-            var actions = "eth.dst = eth.src; eth.src = ${networks.ea}; "
+            var actions = i"eth.dst = eth.src; eth.src = ${networks.ea}; "
                           "ip6.dst = ip6.src; ip6.src = ${ip6_str}; "
                           "outport = inport; flags.loopback = 1; "
                           "output;" in
@@ -6997,16 +6997,16 @@ for (&Router(._uuid = lr_uuid))
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_ND_RA_OPTIONS(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_ND_RA_RESPONSE(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None)
@@ -7058,7 +7058,7 @@ for (Route(.port        = port,
         None     -> "${ipX}.dst"
     } in
     var actions =
-        "${rEG_ECMP_GROUP_ID()} = 0; "
+        i"${rEG_ECMP_GROUP_ID()} = 0; "
         "${xx}${rEG_NEXT_HOP()} = ${nexthop}; "
         "${xx}${rEG_SRC()} = ${src_ip}; "
         "eth.src = ${port.networks.ea}; "
@@ -7069,8 +7069,8 @@ for (Route(.port        = port,
         Flow(.logical_datapath = port.router._uuid,
              .stage            = s_ROUTER_IN_IP_ROUTING(),
              .priority         = priority as integer,
-             .__match          = __match,
-             .actions          = "ip.ttl--; ${actions}",
+             .__match          = __match.intern(),
+             .actions          = i"ip.ttl--; ${actions}",
              .stage_hint       = stage_hint(port.lrp._uuid),
              .io_port          = None,
              .controller_meter = None);
@@ -7079,7 +7079,7 @@ for (Route(.port        = port,
             Flow(.logical_datapath = port.router._uuid,
                  .stage            = s_ROUTER_IN_IP_ROUTING(),
                  .priority         = priority as integer + 1,
-                 .__match          = "${__match} && udp.dst == 3784",
+                 .__match          = i"${__match} && udp.dst == 3784",
                  .actions          = actions,
                  .stage_hint       = stage_hint(port.lrp._uuid),
                  .io_port          = None,
@@ -7092,8 +7092,8 @@ for (Route(.port        = port,
 Flow(.logical_datapath = router._uuid,
      .stage            = s_ROUTER_IN_IP_ROUTING(),
      .priority         = priority as integer,
-     .__match          = ip_match,
-     .actions          = "drop;",
+     .__match          = ip_match.intern(),
+     .actions          = i"drop;",
      .stage_hint       = 0,
      .io_port          = None,
      .controller_meter = None) :-
@@ -7128,8 +7128,8 @@ Route(key, port, src_ip, None) :-
 Flow(.logical_datapath = r._uuid,
      .stage            = s_ROUTER_IN_IP_ROUTING_ECMP(),
      .priority         = 150,
-     .__match          = "${rEG_ECMP_GROUP_ID()} == 0",
-     .actions          = "next;",
+     .__match          = i"${rEG_ECMP_GROUP_ID()} == 0",
+     .actions          = i"next;",
      .stage_hint       = 0,
      .io_port          = None,
      .controller_meter = None) :-
@@ -7211,7 +7211,7 @@ EcmpGroup(group_id, router, key, dsts, route_match, route_priority) :-
 Flow(.logical_datapath = router._uuid,
      .stage            = s_ROUTER_IN_IP_ROUTING(),
      .priority         = route_priority,
-     .__match          = route_match,
+     .__match          = route_match.intern(),
      .actions          = actions,
      .stage_hint       = 0,
      .io_port          = None,
@@ -7225,7 +7225,7 @@ Flow(.logical_datapath = router._uuid,
         member_ids.join(", ")
     },
     var actions =
-        "ip.ttl--; "
+        i"ip.ttl--; "
         "flags.loopback = 1; "
         "${rEG_ECMP_GROUP_ID()} = ${group_id}; " /* XXX */
         "${rEG_ECMP_MEMBER_ID()} = select(${all_member_ids});".
@@ -7242,9 +7242,9 @@ Flow(.logical_datapath = router._uuid,
     var member_id_and_dst = FlatMap(numbered_vec(dsts)),
     (var member_id, var dst) = member_id_and_dst,
     var xx = dst.nexthop.xxreg(),
-    var __match = "${rEG_ECMP_GROUP_ID()} == ${group_id} && "
+    var __match = i"${rEG_ECMP_GROUP_ID()} == ${group_id} && "
                   "${rEG_ECMP_MEMBER_ID()} == ${member_id}",
-    var actions = "${xx}${rEG_NEXT_HOP()} = ${dst.nexthop}; "
+    var actions = i"${xx}${rEG_NEXT_HOP()} = ${dst.nexthop}; "
                   "${xx}${rEG_SRC()} = ${dst.src_ip}; "
                   "eth.src = ${dst.port.networks.ea}; "
                   "outport = ${dst.port.json_name}; "
@@ -7269,12 +7269,12 @@ Flow(.logical_datapath = router._uuid,
      .stage = s_ROUTER_IN_DEFRAG(),
      .priority = 100,
      .__match = __match,
-     .actions = "ct_next;",
+     .actions = i"ct_next;",
      .stage_hint = 0,
      .io_port          = None,
      .controller_meter = None) :-
     EcmpSymmetricReply(router, dst, route_match, _),
-    var __match = "inport == ${dst.port.json_name} && ${route_match}".
+    var __match = i"inport == ${dst.port.json_name} && ${route_match}".
 
 /* And packets that go out over an ECMP route need conntrack.
    XXX this seems to exactly duplicate the above flow? */
@@ -7291,9 +7291,9 @@ Flow(.logical_datapath = router._uuid,
      .io_port          = None,
      .controller_meter = None) :-
     EcmpSymmetricReply(router, dst, route_match, tunkey),
-    var __match = "inport == ${dst.port.json_name} && ${route_match} && "
+    var __match = i"inport == ${dst.port.json_name} && ${route_match} && "
                   "(ct.new && !ct.est)",
-    var actions = "ct_commit { ct_label.ecmp_reply_eth = eth.src;"
+    var actions = i"ct_commit { ct_label.ecmp_reply_eth = eth.src;"
                   " ct_label.ecmp_reply_port = ${tunkey};}; next;".
 
 /* Bypass ECMP selection if we already have ct_label information
@@ -7302,8 +7302,8 @@ Flow(.logical_datapath = router._uuid,
 Flow(.logical_datapath = router._uuid,
      .stage = s_ROUTER_IN_IP_ROUTING(),
      .priority = 300,
-     .__match = "${ecmp_reply} && ${route_match}",
-     .actions = "ip.ttl--; "
+     .__match = i"${ecmp_reply} && ${route_match}",
+     .actions = i"ip.ttl--; "
                 "flags.loopback = 1; "
                 "eth.src = ${dst.port.networks.ea}; "
                 "${xx}reg1 = ${dst.src_ip}; "
@@ -7317,7 +7317,7 @@ Flow(.logical_datapath = router._uuid,
      .stage = s_ROUTER_IN_POLICY(),
      .priority = 65535,
      .__match = ecmp_reply,
-     .actions = "next;",
+     .actions = i"next;",
      .stage_hint = 0,
      .io_port          = None,
      .controller_meter = None),
@@ -7325,12 +7325,12 @@ Flow(.logical_datapath = router._uuid,
      .stage = s_ROUTER_IN_ARP_RESOLVE(),
      .priority = 200,
      .__match = ecmp_reply,
-     .actions = "eth.dst = ct_label.ecmp_reply_eth; next;",
+     .actions = i"eth.dst = ct_label.ecmp_reply_eth; next;",
      .stage_hint = 0,
      .io_port          = None,
      .controller_meter = None) :-
     EcmpSymmetricReply(router, dst, route_match, tunkey),
-    var ecmp_reply = "ct.rpl && ct_label.ecmp_reply_port == ${tunkey}",
+    var ecmp_reply = i"ct.rpl && ct_label.ecmp_reply_port == ${tunkey}",
     var xx = dst.nexthop.xxreg().
 
 
@@ -7343,8 +7343,8 @@ Flow(.logical_datapath = router._uuid,
 Flow(.logical_datapath = router._uuid,
      .stage            = s_ROUTER_IN_IP_ROUTING(),
      .priority         = 550,
-     .__match          = "nd_rs || nd_ra",
-     .actions          = "drop;",
+     .__match          = i"nd_rs || nd_ra",
+     .actions          = i"drop;",
      .stage_hint       = 0,
      .io_port          = None,
      .controller_meter = None) :-
@@ -7370,9 +7370,9 @@ for (IgmpRouterMulticastGroup(address, rtr, ports)) {
         Flow(.logical_datapath = rtr._uuid,
              .stage            = s_ROUTER_IN_IP_ROUTING(),
              .priority         = 500,
-             .__match          = "${ipX} && ${ipX}.dst == ${address} ",
+             .__match          = i"${ipX} && ${ipX}.dst == ${address} ",
              .actions          =
-                "${static_act}outport = ${json_string_escape(address)}; "
+                i"${static_act}outport = ${json_string_escape(address)}; "
                 "ip.ttl--; next;",
              .stage_hint       = 0,
              .io_port          = None,
@@ -7387,18 +7387,18 @@ for (RouterMcastFloodPorts(rtr, flood_ports) if rtr.mcast_cfg.relay) {
     var mc_static = json_string_escape(mC_STATIC().0) in
     var flood_static = not flood_ports.is_empty() in
     var actions = if (flood_static) {
-        "clone { "
+        i"clone { "
             "outport = ${mc_static}; "
             "ip.ttl--; "
             "next; "
         "};"
     } else {
-        "drop;"
+        i"drop;"
     } in
     Flow(.logical_datapath = rtr._uuid,
          .stage            = s_ROUTER_IN_IP_ROUTING(),
          .priority         = 450,
-         .__match          = "ip4.mcast || ip6.mcast",
+         .__match          = i"ip4.mcast || ip6.mcast",
          .actions          = actions,
          .stage_hint       = 0,
          .io_port          = None,
@@ -7420,8 +7420,8 @@ for (&Router(._uuid = lr_uuid)) {
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_POLICY(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "${rEG_ECMP_GROUP_ID()} = 0; next;",
+         .__match          = i"1",
+         .actions          = i"${rEG_ECMP_GROUP_ID()} = 0; next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
@@ -7429,8 +7429,8 @@ for (&Router(._uuid = lr_uuid)) {
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_POLICY_ECMP(),
          .priority         = 150,
-         .__match          = "${rEG_ECMP_GROUP_ID()} == 0",
-         .actions          = "next;",
+         .__match          = i"${rEG_ECMP_GROUP_ID()} == 0",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None)
@@ -7448,8 +7448,8 @@ function pkt_mark_policy(options: Map<string,string>): string {
 Flow(.logical_datapath = r._uuid,
      .stage            = s_ROUTER_IN_POLICY(),
      .priority         = policy.priority,
-     .__match          = policy.__match,
-     .actions          = actions,
+     .__match          = policy.__match.intern(),
+     .actions          = actions.intern(),
      .stage_hint       = stage_hint(policy._uuid),
      .io_port          = None,
      .controller_meter = None) :-
@@ -7512,7 +7512,7 @@ Flow(.logical_datapath = r._uuid,
      .stage            = s_ROUTER_IN_POLICY_ECMP(),
      .priority         = 100,
      .__match          = __match,
-     .actions          = actions,
+     .actions          = actions.intern(),
      .stage_hint       = stage_hint(policy._uuid),
      .io_port          = None,
      .controller_meter = None) :-
@@ -7532,12 +7532,12 @@ Flow(.logical_datapath = r._uuid,
                    "outport = ${out_port.json_name}; "
                    "flags.loopback = 1; "
                    "next;"),
-    var __match = ("${rEG_ECMP_GROUP_ID()} == ${ecmp_group_id} && "
-                   "${rEG_ECMP_MEMBER_ID()} == ${member_id}").
+    var __match = i"${rEG_ECMP_GROUP_ID()} == ${ecmp_group_id} && "
+                  "${rEG_ECMP_MEMBER_ID()} == ${member_id}".
 Flow(.logical_datapath = r._uuid,
      .stage            = s_ROUTER_IN_POLICY(),
      .priority         = policy.priority,
-     .__match          = policy.__match,
+     .__match          = policy.__match.intern(),
      .actions          = actions,
      .stage_hint       = stage_hint(policy._uuid),
      .io_port          = None,
@@ -7551,14 +7551,14 @@ Flow(.logical_datapath = r._uuid,
         };
         member_ids.join(", ")
     },
-    var actions = ("${rEG_ECMP_GROUP_ID()} = ${ecmp_group_id}; "
-                   "${rEG_ECMP_MEMBER_ID()} = select(${member_ids});").
+    var actions = i"${rEG_ECMP_GROUP_ID()} = ${ecmp_group_id}; "
+                  "${rEG_ECMP_MEMBER_ID()} = select(${member_ids});".
 
 Flow(.logical_datapath = r._uuid,
      .stage            = s_ROUTER_IN_POLICY(),
      .priority         = policy.priority,
-     .__match          = policy.__match,
-     .actions          = "drop;",
+     .__match          = policy.__match.intern(),
+     .actions          = i"drop;",
      .stage_hint       = stage_hint(policy._uuid),
      .io_port          = None,
      .controller_meter = None) :-
@@ -7569,8 +7569,8 @@ Flow(.logical_datapath = r._uuid,
 Flow(.logical_datapath = r._uuid,
      .stage            = s_ROUTER_IN_POLICY(),
      .priority         = policy.priority,
-     .__match          = policy.__match,
-     .actions          = pkt_mark_policy(policy.options) ++ "${rEG_ECMP_GROUP_ID()} = 0; next;",
+     .__match          = policy.__match.intern(),
+     .actions          = (pkt_mark_policy(policy.options) ++ "${rEG_ECMP_GROUP_ID()} = 0; next;").intern(),
      .stage_hint       = stage_hint(policy._uuid),
      .io_port          = None,
      .controller_meter = None) :-
@@ -7591,8 +7591,8 @@ for (&Router(._uuid = lr_uuid)) {
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_ARP_RESOLVE(),
          .priority         = 500,
-         .__match          = "ip4.mcast || ip6.mcast",
-         .actions          = "next;",
+         .__match          = i"ip4.mcast || ip6.mcast",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None)
@@ -7628,8 +7628,8 @@ for (rp in &RouterPort(.peer = PeerRouter{peer_port, _},
             Flow(.logical_datapath = peer_router._uuid,
                  .stage            = s_ROUTER_IN_ARP_RESOLVE(),
                  .priority         = 100,
-                 .__match          = __match,
-                 .actions          = "eth.dst = ${networks.ea}; next;",
+                 .__match          = __match.intern(),
+                 .actions          = i"eth.dst = ${networks.ea}; next;",
                  .stage_hint       = stage_hint(rp.lrp._uuid),
                  .io_port          = None,
                  .controller_meter = None)
@@ -7642,8 +7642,8 @@ for (rp in &RouterPort(.peer = PeerRouter{peer_port, _},
             Flow(.logical_datapath = peer_router._uuid,
                  .stage            = s_ROUTER_IN_ARP_RESOLVE(),
                  .priority         = 100,
-                 .__match          = __match,
-                 .actions          = "eth.dst = ${networks.ea}; next;",
+                 .__match          = __match.intern(),
+                 .actions          = i"eth.dst = ${networks.ea}; next;",
                  .stage_hint       = stage_hint(rp.lrp._uuid),
                  .io_port          = None,
                  .controller_meter = None)
@@ -7660,9 +7660,9 @@ for (rp in &RouterPort(.peer = PeerRouter{peer_port, _},
 Flow(.logical_datapath = router._uuid,
      .stage            = s_ROUTER_IN_ARP_RESOLVE(),
      .priority         = 50,
-     .__match          = "outport == ${rp.json_name} && "
+     .__match          = i"outport == ${rp.json_name} && "
                          "!is_chassis_resident(${json_string_escape(chassis_redirect_name(l3dgw_port.name))})",
-     .actions          = "eth.dst = ${rp.networks.ea}; next;",
+     .actions          = i"eth.dst = ${rp.networks.ea}; next;",
      .stage_hint       = stage_hint(lrp._uuid),
      .io_port          = None,
      .controller_meter = None) :-
@@ -7680,8 +7680,8 @@ Flow(.logical_datapath = router._uuid,
 Flow(.logical_datapath = lr_uuid,
      .stage = s_ROUTER_IN_ARP_RESOLVE(),
      .priority = 1,
-     .__match = "ip4.dst == {" ++ match_ips.join(", ") ++ "}",
-     .actions = "drop;",
+     .__match = ("ip4.dst == {" ++ match_ips.join(", ") ++ "}").intern(),
+     .actions = i"drop;",
      .stage_hint = stage_hint(lrp_uuid),
      .io_port          = None,
      .controller_meter = None) :-
@@ -7695,8 +7695,8 @@ Flow(.logical_datapath = lr_uuid,
 Flow(.logical_datapath = lr_uuid,
      .stage = s_ROUTER_IN_ARP_RESOLVE(),
      .priority = 1,
-     .__match = "ip6.dst == {" ++ match_ips.join(", ") ++ "}",
-     .actions = "drop;",
+     .__match = ("ip6.dst == {" ++ match_ips.join(", ") ++ "}").intern(),
+     .actions = i"drop;",
      .stage_hint = stage_hint(lrp_uuid),
      .io_port          = None,
      .controller_meter = None) :-
@@ -7714,8 +7714,8 @@ Flow(.logical_datapath = lr_uuid,
 Flow(.logical_datapath = peer.router._uuid,
      .stage = s_ROUTER_IN_ARP_RESOLVE(),
      .priority = 100,
-     .__match = "outport == ${peer.json_name} && " ++ rEG_NEXT_HOP() ++ " == {${ips}}",
-     .actions = "eth.dst = ${addr.ea}; next;",
+     .__match = ("outport == ${peer.json_name} && " ++ rEG_NEXT_HOP() ++ " == {${ips}}").intern(),
+     .actions = i"eth.dst = ${addr.ea}; next;",
      .stage_hint = stage_hint(lrp._uuid),
      .io_port          = None,
      .controller_meter = None) :-
@@ -7745,9 +7745,9 @@ for (SwitchPortIPv4Address(
         Flow(.logical_datapath = peer_router._uuid,
              .stage            = s_ROUTER_IN_ARP_RESOLVE(),
              .priority         = 100,
-             .__match          = "outport == ${peer.json_name} && "
+             .__match          = i"outport == ${peer.json_name} && "
                                  "${rEG_NEXT_HOP()} == ${addr.addr}",
-             .actions          = "eth.dst = ${ea}; next;",
+             .actions          = i"eth.dst = ${ea}; next;",
              .stage_hint       = stage_hint(lsp._uuid),
              .io_port          = None,
              .controller_meter = None)
@@ -7767,9 +7767,9 @@ for (SwitchPortIPv6Address(
         Flow(.logical_datapath = peer_router._uuid,
              .stage            = s_ROUTER_IN_ARP_RESOLVE(),
              .priority         = 100,
-             .__match          = "outport == ${peer.json_name} && "
+             .__match          = i"outport == ${peer.json_name} && "
                                  "xx${rEG_NEXT_HOP()} == ${addr.addr}",
-             .actions          = "eth.dst = ${ea}; next;",
+             .actions          = i"eth.dst = ${ea}; next;",
              .stage_hint       = stage_hint(lsp._uuid),
              .io_port          = None,
              .controller_meter = None)
@@ -7799,9 +7799,9 @@ function is_empty_set_or_string(s: Option<string>): bool = {
 Flow(.logical_datapath = peer.router._uuid,
      .stage            = s_ROUTER_IN_ARP_RESOLVE(),
      .priority         = 100,
-     .__match          = "outport == ${peer.json_name} && "
+     .__match          = i"outport == ${peer.json_name} && "
                          "${rEG_NEXT_HOP()} == ${virtual_ip}",
-     .actions          = "eth.dst = 00:00:00:00:00:00; next;",
+     .actions          = i"eth.dst = 00:00:00:00:00:00; next;",
      .stage_hint       = stage_hint(sp.lsp._uuid),
      .io_port          = None,
      .controller_meter = None) :-
@@ -7816,9 +7816,9 @@ Flow(.logical_datapath = peer.router._uuid,
 Flow(.logical_datapath = peer.router._uuid,
      .stage            = s_ROUTER_IN_ARP_RESOLVE(),
      .priority         = 100,
-     .__match          = "outport == ${peer.json_name} && "
+     .__match          = i"outport == ${peer.json_name} && "
                          "${rEG_NEXT_HOP()} == ${virtual_ip}",
-     .actions          = "eth.dst = ${address.ea}; next;",
+     .actions          = i"eth.dst = ${address.ea}; next;",
      .stage_hint       = stage_hint(sp.lsp._uuid),
      .io_port          = None,
      .controller_meter = None) :-
@@ -7855,9 +7855,9 @@ for (&SwitchPort(.lsp = lsp1,
             Flow(.logical_datapath = peer_router._uuid,
                  .stage            = s_ROUTER_IN_ARP_RESOLVE(),
                  .priority         = 100,
-                 .__match          = "outport == ${peer1.json_name} && "
+                 .__match          = i"outport == ${peer1.json_name} && "
                                      "${rEG_NEXT_HOP()} == ${format_v4_networks(peer2.networks, false)}",
-                 .actions          = "eth.dst = ${peer2.networks.ea}; next;",
+                 .actions          = i"eth.dst = ${peer2.networks.ea}; next;",
                  .stage_hint       = stage_hint(lsp1._uuid),
                  .io_port          = None,
                  .controller_meter = None)
@@ -7867,9 +7867,9 @@ for (&SwitchPort(.lsp = lsp1,
             Flow(.logical_datapath = peer_router._uuid,
                  .stage            = s_ROUTER_IN_ARP_RESOLVE(),
                  .priority         = 100,
-                 .__match          = "outport == ${peer1.json_name} && "
+                 .__match          = i"outport == ${peer1.json_name} && "
                                      "xx${rEG_NEXT_HOP()} == ${format_v6_networks(peer2.networks)}",
-                 .actions          = "eth.dst = ${peer2.networks.ea}; next;",
+                 .actions          = i"eth.dst = ${peer2.networks.ea}; next;",
                  .stage_hint       = stage_hint(lsp1._uuid),
                  .io_port          = None,
                  .controller_meter = None)
@@ -7882,16 +7882,16 @@ for (&Router(._uuid = lr_uuid))
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_ARP_RESOLVE(),
          .priority         = 0,
-         .__match          = "ip4",
-         .actions          = "get_arp(outport, ${rEG_NEXT_HOP()}); next;",
+         .__match          = i"ip4",
+         .actions          = i"get_arp(outport, ${rEG_NEXT_HOP()}); next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None);
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_ARP_RESOLVE(),
          .priority         = 0,
-         .__match          = "ip6",
-         .actions          = "get_nd(outport, xx${rEG_NEXT_HOP()}); next;",
+         .__match          = i"ip6",
+         .actions          = i"get_nd(outport, xx${rEG_NEXT_HOP()}); next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None)
@@ -7913,8 +7913,8 @@ for (&Router(._uuid = lr_uuid))
 Flow(.logical_datapath = lr_uuid,
      .stage            = s_ROUTER_IN_CHK_PKT_LEN(),
      .priority         = 0,
-     .__match          = "1",
-     .actions          = "next;",
+     .__match          = i"1",
+     .actions          = i"next;",
      .stage_hint       = 0,
      .io_port          = None,
      .controller_meter = None) :-
@@ -7922,8 +7922,8 @@ Flow(.logical_datapath = lr_uuid,
 Flow(.logical_datapath = lr_uuid,
      .stage            = s_ROUTER_IN_LARGER_PKTS(),
      .priority         = 0,
-     .__match          = "1",
-     .actions          = "next;",
+     .__match          = i"1",
+     .actions          = i"next;",
      .stage_hint       = 0,
      .io_port          = None,
      .controller_meter = None) :-
@@ -7931,8 +7931,8 @@ Flow(.logical_datapath = lr_uuid,
 Flow(.logical_datapath = lr_uuid,
      .stage            = s_ROUTER_IN_CHK_PKT_LEN(),
      .priority         = 50,
-     .__match          = "outport == ${gw_mtu_rp.json_name}",
-     .actions          = "${rEGBIT_PKT_LARGER()} = check_pkt_larger(${mtu}); "
+     .__match          = i"outport == ${gw_mtu_rp.json_name}",
+     .actions          = i"${rEGBIT_PKT_LARGER()} = check_pkt_larger(${mtu}); "
                          "next;",
      .stage_hint       = stage_hint(gw_mtu_rp.lrp._uuid),
      .io_port          = None,
@@ -7945,9 +7945,9 @@ Flow(.logical_datapath = lr_uuid,
 Flow(.logical_datapath = lr_uuid,
      .stage            = s_ROUTER_IN_LARGER_PKTS(),
      .priority         = 150,
-     .__match          = "inport == ${rp.json_name} && outport == ${gw_mtu_rp.json_name} && ip4 && "
+     .__match          = i"inport == ${rp.json_name} && outport == ${gw_mtu_rp.json_name} && ip4 && "
                          "${rEGBIT_PKT_LARGER()} && ${rEGBIT_EGRESS_LOOPBACK()} == 0",
-     .actions          = "icmp4_error {"
+     .actions          = i"icmp4_error {"
                          "${rEGBIT_EGRESS_LOOPBACK()} = 1; "
                          "${rEGBIT_PKT_LARGER()} = 0; "
                          "eth.dst = ${rp.networks.ea}; "
@@ -7975,9 +7975,9 @@ Flow(.logical_datapath = lr_uuid,
 Flow(.logical_datapath = lr_uuid,
      .stage            = s_ROUTER_IN_IP_INPUT(),
      .priority         = 150,
-     .__match          = "inport == ${rp.json_name} && ip4 && "
+     .__match          = i"inport == ${rp.json_name} && ip4 && "
                          "${rEGBIT_PKT_LARGER()} && ${rEGBIT_EGRESS_LOOPBACK()} == 0",
-     .actions          = "icmp4_error {"
+     .actions          = i"icmp4_error {"
                          "${rEGBIT_EGRESS_LOOPBACK()} = 1; "
                          "${rEGBIT_PKT_LARGER()} = 0; "
                          "eth.dst = ${rp.networks.ea}; "
@@ -8005,9 +8005,9 @@ Flow(.logical_datapath = lr_uuid,
 Flow(.logical_datapath = lr_uuid,
      .stage            = s_ROUTER_IN_LARGER_PKTS(),
      .priority         = 150,
-     .__match          = "inport == ${rp.json_name} && outport == ${gw_mtu_rp.json_name} && ip6 && "
+     .__match          = i"inport == ${rp.json_name} && outport == ${gw_mtu_rp.json_name} && ip6 && "
                          "${rEGBIT_PKT_LARGER()} && ${rEGBIT_EGRESS_LOOPBACK()} == 0",
-     .actions          = "icmp6_error {"
+     .actions          = i"icmp6_error {"
                          "${rEGBIT_EGRESS_LOOPBACK()} = 1; "
                          "${rEGBIT_PKT_LARGER()} = 0; "
                          "eth.dst = ${rp.networks.ea}; "
@@ -8035,9 +8035,9 @@ Flow(.logical_datapath = lr_uuid,
 Flow(.logical_datapath = lr_uuid,
      .stage            = s_ROUTER_IN_IP_INPUT(),
      .priority         = 150,
-     .__match          = "inport == ${rp.json_name} && ip6 && "
+     .__match          = i"inport == ${rp.json_name} && ip6 && "
                          "${rEGBIT_PKT_LARGER()} && ${rEGBIT_EGRESS_LOOPBACK()} == 0",
-     .actions          = "icmp6_error {"
+     .actions          = i"icmp6_error {"
                          "${rEGBIT_EGRESS_LOOPBACK()} = 1; "
                          "${rEGBIT_PKT_LARGER()} = 0; "
                          "eth.dst = ${rp.networks.ea}; "
@@ -8079,8 +8079,8 @@ for (&Router(._uuid = lr_uuid))
         Flow(.logical_datapath = lr_uuid,
              .stage            = s_ROUTER_IN_GW_REDIRECT(),
              .priority         = 50,
-             .__match          = "outport == ${json_string_escape(lrp.name)}",
-             .actions          = "outport = ${json_string_escape(chassis_redirect_name(lrp.name))}; next;",
+             .__match          = i"outport == ${json_string_escape(lrp.name)}",
+             .actions          = i"outport = ${json_string_escape(chassis_redirect_name(lrp.name))}; next;",
              .stage_hint       = stage_hint(lrp._uuid),
              .io_port          = None,
              .controller_meter = None)
@@ -8090,8 +8090,8 @@ for (&Router(._uuid = lr_uuid))
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_GW_REDIRECT(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "next;",
+         .__match          = i"1",
+         .actions          = i"next;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None)
@@ -8113,12 +8113,12 @@ Flow(.logical_datapath = router._uuid,
     rsr in RouterStaticRoute(.router = router),
     var dst = FlatMap(rsr.dsts),
     IPv6{var gw_ip6} = dst.nexthop,
-    var __match = "eth.dst == 00:00:00:00:00:00 && "
+    var __match = i"eth.dst == 00:00:00:00:00:00 && "
                   "ip6 && xx${rEG_NEXT_HOP()} == ${dst.nexthop}",
     var sn_addr = gw_ip6.solicited_node(),
     var eth_dst = sn_addr.multicast_to_ethernet(),
     var sn_addr_s = sn_addr.string_mapped(),
-    var actions = "nd_ns { "
+    var actions = i"nd_ns { "
                   "eth.dst = ${eth_dst}; "
                   "ip6.dst = ${sn_addr_s}; "
                   "nd.target = ${dst.nexthop}; "
@@ -8130,8 +8130,8 @@ for (&Router(._uuid = lr_uuid, .copp = copp))
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_ARP_REQUEST(),
          .priority         = 100,
-         .__match          = "eth.dst == 00:00:00:00:00:00 && ip4",
-         .actions          = "arp { "
+         .__match          = i"eth.dst == 00:00:00:00:00:00 && ip4",
+         .actions          = i"arp { "
                              "eth.dst = ff:ff:ff:ff:ff:ff; "
                              "arp.spa = ${rEG_SRC()}; "
                              "arp.tpa = ${rEG_NEXT_HOP()}; "
@@ -8145,8 +8145,8 @@ for (&Router(._uuid = lr_uuid, .copp = copp))
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_ARP_REQUEST(),
          .priority         = 100,
-         .__match          = "eth.dst == 00:00:00:00:00:00 && ip6",
-         .actions          = "nd_ns { "
+         .__match          = i"eth.dst == 00:00:00:00:00:00 && ip6",
+         .actions          = i"nd_ns { "
                              "nd.target = xx${rEG_NEXT_HOP()}; "
                              "output; "
                              "};",
@@ -8157,8 +8157,8 @@ for (&Router(._uuid = lr_uuid, .copp = copp))
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_IN_ARP_REQUEST(),
          .priority         = 0,
-         .__match          = "1",
-         .actions          = "output;",
+         .__match          = i"1",
+         .actions          = i"output;",
          .stage_hint       = 0,
          .io_port          = None,
          .controller_meter = None)
@@ -8183,9 +8183,9 @@ for (&RouterPort(.lrp = lrp,
         Flow(.logical_datapath = lr_uuid,
              .stage            = s_ROUTER_OUT_DELIVERY(),
              .priority         = 110,
-             .__match          = "(ip4.mcast || ip6.mcast) && "
+             .__match          = i"(ip4.mcast || ip6.mcast) && "
                                  "outport == ${json_name}",
-             .actions          = "eth.src = ${lrp_networks.ea}; output;",
+             .actions          = i"eth.src = ${lrp_networks.ea}; output;",
              .stage_hint       = stage_hint(lrp._uuid),
              .io_port          = None,
              .controller_meter = None)
@@ -8198,8 +8198,8 @@ for (&RouterPort(.lrp = lrp,
     Flow(.logical_datapath = lr_uuid,
          .stage            = s_ROUTER_OUT_DELIVERY(),
          .priority         = 100,
-         .__match          = "outport == ${json_name}",
-         .actions          = "output;",
+         .__match          = i"outport == ${json_name}",
+         .actions          = i"output;",
          .stage_hint       = stage_hint(lrp._uuid),
          .io_port          = None,
          .controller_meter = None)
@@ -8839,16 +8839,16 @@ function lrouter_bfd_flows(lr_uuid: uuid,
     (Flow{.logical_datapath = lr_uuid,
           .stage            = s_ROUTER_IN_IP_INPUT(),
           .priority         = 110,
-          .__match          = "${ipX}.src == ${networks} && udp.dst == 3784",
-          .actions          = "next; ",
+          .__match          = i"${ipX}.src == ${networks} && udp.dst == 3784",
+          .actions          = i"next; ",
           .stage_hint       = stage_hint(lrp_uuid),
          .io_port          = None,
          .controller_meter = None},
      Flow{.logical_datapath = lr_uuid,
           .stage            = s_ROUTER_IN_IP_INPUT(),
           .priority         = 110,
-          .__match          = "${ipX}.dst == ${networks} && udp.dst == 3784",
-          .actions          = "handle_bfd_msg(); ",
+          .__match          = i"${ipX}.dst == ${networks} && udp.dst == 3784",
+          .actions          = i"handle_bfd_msg(); ",
           .io_port          = None,
           .controller_meter = controller_meter,
           .stage_hint       = stage_hint(lrp_uuid)})
