Using a subfolder setup, when the user selects a tag after a category or a category after a tag, Discourse is using the route
/[subfolder]/tags/[subfolder]/c/[category slug]/[category id]/[tag]
instead of
/[subfolder]/tags/c/[category slug]/[category id]/[tag]
Both tag-drop.js and category-drop.js are calling getCategoryAndTagUrl, it uses category.js#url – which prepends the subfolder by calling get-url.js#getURL – to concatenate after /tags/. tag-drop-link.js also uses the same url method.