One app refuses the proxy: three ways in

Browser fine, one app connecting directly or failing? That app is not using the system proxy. Classify it, then choose:

Route 1: the app's own proxy settings

Many apps have one (Telegram, Steam, JetBrains IDEs, qBittorrent …). Enter SOCKS5 or HTTP 127.0.0.1:7890 in its network settings — the most surgical fix.

Route 2: environment variables for CLI tools

# current PowerShell session
$env:HTTP_PROXY  = "http://127.0.0.1:7890"
$env:HTTPS_PROXY = "http://127.0.0.1:7890"

# git, persistently
git config --global http.proxy http://127.0.0.1:7890

pip, npm, go and friends each have an equivalent setting — configure once, works forever.

Route 3: TUN takes all

No proxy settings and ignores environment variables (most games, some clients)? Enable TUN mode and intercept at the network layer — "TUN mode explained".

Verification is always the same: make the app generate traffic, find it on the Connections page by process/domain, and read the Chains column. If the traffic never appears there, it never entered Clash — go back to the three routes.