Additional test cases added, verified behavior is also present on test.wikipedia.org

What are the values? The links in description point to nothing for me.

Looks like the logged wrapped since that report, I'll have to regenerate the tests and document. IIRC, the variable was blank instead of populated.

OK duplicated, moved a page on enwiki from Main (NS:0) wo Wikipedia (NS:4)

Standard move with redirect :

Edit filter shows (https://en.wikipedia.org/wiki/Special:AbuseFilter/examine/812428331)

Namespace of move destination page (moved_to_namespace): 0

Similar move without redirect :

Edit filter shows (https://en.wikipedia.org/wiki/Special:AbuseFilter/examine/812429316)

Namespace of move destination page (moved_to_namespace): 1

The exact same behavior is still present on test and test2 as well

https://test.wikipedia.org/wiki/Special:AbuseFilter/examine/333393

https://test2.wikipedia.org/wiki/Special:AbuseFilter/examine/426493

This is broken since 6c89ccc2fe032acfe7b269543e69d78706ad1d0b (https://gerrit.wikimedia.org/r/#/c/104706/), but then, that patch claims to "Make MOVED_TO* var generating from RecentChanges working", so presumably it was broken in a different way before. It's interpreting log parameters wrong, treating the with/without-redirect value (0 or 1) as if it was a namespace (main or Talk).

Change 281483 had a related patch set uploaded (by Bartosz Dziewoński):
Interpret data correctly in getMoveVarsFromRCRow()

https://gerrit.wikimedia.org/r/281483

I think this only affects Special:AbuseFilter/examine, and not the actual filter matching.

It appears the AF is failing to match when using that variable in a rule - assuming that the /examine is reporting what the variable is?

I think /examine is lying. :)

My bad. Sorry :/

Change 281483 merged by jenkins-bot:
Interpret data correctly in getMoveVarsFromRCRow()

https://gerrit.wikimedia.org/r/281483