The answer: Clean up your darned imports
@patch('mymodule.TAX_LOCATION', '') did indeed patch things appropriately, but since our imports at the time were very haphazard — sometimes we imported mymodule.build_cart, sometimes we imported project.mymodule.build_cart — instances of the “full” import were not patched at all. Mock couldn’t be expected to know about the two separate import paths… without being told explicitly, anyway.
We’ve since standardized all our imports on the longer path, and things behave much more nicely now.