Subscription download failures: errors and fixes

When downloading or updating a subscription fails on the Profiles page, the error text is the clue:

• 404 / 403: dead link — the URL changed (copy a fresh one from the provider's user portal), the token was reset, or the plan expired and the server refuses;
• timeout / connection refused: the subscription host is unreachable from your network. The classic deadlock: the URL itself needs a proxy, and you have no working profile yet. Fixes: download once over a phone hotspot, or if an older profile still has a live node, use update-via-proxy (Alt-click the update button);
• SSL/TLS errors: system clock wrong (fix time sync) or the host's certificate is genuinely broken (wait for the provider);
• Downloaded but YAML parse fails: the server returned something that is not a config — typically an HTML error page served for a bad token. Open the URL in a browser and look; if it is a real format issue, see "Common YAML config errors";
• Downloads fine but zero nodes: the link is a generic base64 node list, not Clash format. Look for the link labeled "Clash" in the provider's portal, or run it through a subscription converter.

Universal fallback: open the subscription URL in a browser. YAML text → client-side problem; error page or garbage → the link or the provider.