It is somewhat difficult to examine old edits, do you have any recent examples? (ones that would still have extra information in the recent changes tables)

I think you may need to use added_lines_pst instead of added_lines.

In T309571#7969706, @Daimona wrote:

In T309571#7969668, @matej_suchanek wrote:

I think you may need to use added_lines_pst instead of added_lines.

Correct. added_lines contain the exact text entered by the user, so the signature is not transformed. If you want to add conditions on expanded signatures, substed templates, pipe tricks etc., you should use added_lines_pst; see documentation. This also means that in your example, you can simply check whether added_lines contain ~~~~, which is possibly easier to read and more performant. Either way, the AbuseFilter itself is working as intended.

I had never noticed added_lines_pst, but apparently it wouldn't work in this case as edits on this page are expected to have signatures inside transcluded pages. I will try to go with ~~~~ and watch the results. Thanks for the help!

That is where the "examine" function on recent changes can be extremely helpful, so you can see the contents of each of those sections.

In T309571#7971196, @Xaosflux wrote:

That is where the "examine" function on recent changes can be extremely helpful, so you can see the contents of each of those sections.

Beware, you cannot infer what added_lines was from live content if the PST (pre-save transform) was applied. If available, added_lines and added_lines_pst will always have the same content when using "examine" function on recent changes.