Okay, I think I know what the difference is: create, newuser, rights and upload all create a new RecentChange, and RecentChange::save() includes a call to the RecentChange_save hook, which is where MWOAuthSessionProvider adds the OAuth CID: tag. Patrolling, on the other hand, only updates a recent change and doesn’t use this hook.

I’m not sure how easy this is to fix. RecentChange::doMarkPatrolled() calls the MarkPatrolled hook, but that doesn’t include the $tags argument, so even if the OAuth extension were to subscribe to that hook, it couldn’t add any tags here in its current form. Is it possible to add arguments to a hook without breaking compatibility with existing subscribers? (Though the hook has no known subscribers, so perhaps we could just bite the bullet and make the breaking change.)

Adding new arguments to a hook should be safe, as long as it doesn't alter the handling of the existing ones.

Change 500177 had a related patch set uploaded (by Lucas Werkmeister; owner: Lucas Werkmeister (WMDE)):
[mediawiki/extensions/OAuth@master] Add "OAuth CID: $consumerId" tag to patrol log

https://gerrit.wikimedia.org/r/500177

Change 500176 had a related patch set uploaded (by Lucas Werkmeister; owner: Lucas Werkmeister (WMDE)):
[mediawiki/core@master] Add &$tags argument to MarkPatrolled hook

https://gerrit.wikimedia.org/r/500176

Change 500176 merged by jenkins-bot:
[mediawiki/core@master] Add &$tags argument to MarkPatrolled hook

https://gerrit.wikimedia.org/r/500176

Any volunteers for reviewing the second change? Here are some Python commands I used to patrol an edit via OAuth on my local wiki, perhaps they’re useful to others who want to test this as well.

Change 500177 merged by Lucas Werkmeister (WMDE):
[mediawiki/extensions/OAuth@master] Add "OAuth CID: $consumerId" tag to patrol log

https://gerrit.wikimedia.org/r/500177