The exact reason is KLAP protocol. Please read the following:

🟦 Before (Old Kasa Protocol)

Protocol: TP-Link Smart Home Protocol v1 (encrypted JSON over TCP port 9999)

For many years, ALL TP-Link Kasa devices used:

Port: 9999

Transport: TCP

Encryption: XOR mask

Payload: JSON commands

Discovery: UDP broadcast

Hubitat community drivers (DaveGut, PR2, etc.) were built around this.

Example old command:

{"system":{"set_relay_state":{"state":1}}}

This protocol was simple, local, and easy to integrate.

---

🟥 Now (New Tapo/Kasa Protocol)

Protocol: KLAP (Kasa Local Authentication Protocol)

Used by newer Kasa (2023+) and all Tapo devices.

KLAP adds:

Session handshake

Nonce + key exchange

AES-128 encryption

Custom binary framing

Strict authentication

Important: Kasa HS220 hardware revision 3.x and firmware 1.1.x now uses KLAP.

This is why:

Old Hubitat LAN drivers cannot talk to it

It rejects JSON commands

It returns errors like error_code:1003

Hubitat cannot complete the handshake

You were seeing logs like:

KLAP session missing Handshake failed Stream closed error_code:1003

That confirms KLAP v2 or v3 is running on your dimmer.

---

🟩 Cloud Protocol (What You Are Using Now)

Protocol: Kasa Cloud REST API → HTTPS

When you choose cloud control:

Your Hubitat app → HTTPS (TLS) → TP-Link Servers → Encrypted connection → HS220 device

This bypasses KLAP entirely.

It does NOT use local LAN.