TCC block→recovery funnel — the churn lever. Of machines that hit a Calendar/Contacts/Reminders permission wall in the window (a tool of that service returned permission_denied / tcc_* ), what happened next:

• recovered: every blocked service is now granted (effective state from outcomes)
• partial: some but not all blocked services granted
• stuck_active: still denied AND still active (last heartbeat <7d) → INTERVENTION TARGET
• churned_or_inactive: no heartbeat in 7d The stuck_machines list is who to nudge (active, blocked, recoverable).