Home Assistant Tuya: "network error (-9999999) sign invalid" then re-auth

The thread on this has got as far as a plausible mechanism, and it is worth knowing because it predicts when you will see it.

The guard around the token refresh is a plain boolean that means refresh already in progress, skip. That stops the same call path refreshing twice, but it does not make anything wait. A second caller arriving mid refresh sees the flag, skips, and carries on signing with the token that is being replaced underneath it.

So it is a race, not a leak, and the odds go up with concurrency.

The word to hold on to is sign. That error is not about reachability at all, it is the vendor rejecting the signature on your request. Your credentials are fine and so is your network, which is exactly why every network check you run comes back clean.

Requests are signed with the current access token. When the token is refreshed and something is still holding the old one, the signature computed no longer matches what the server expects, and you get an instant rejection rather than a timeout. Instant is the tell. A network problem makes you wait.

Practical mitigation until it is fixed upstream, since you cannot patch the vendor cloud: put a small delay between the commands in that group so they do not all hit the API in the same instant. Half a second between them was enough here. It is not elegant and it does not fix the underlying race, it just stops one automation from being the thing that reliably triggers it.

Longer answer nobody wants: the devices that keep doing this to you are the ones where a working light switch depends on a signature check in another country. Where a local protocol exists for the same hardware, moving to it removes this class of failure rather than reducing it.

Add a template sensor for the integration's auth state and alert on it. You cannot stop it yet, but you can stop finding out from a light that will not turn on.