An example of a fairly common ASTRO 25 setup would be a simulcast cell comprised of 10 subsites using 10 frequencies. Ch 1 is flagged as the most preferred control channel, with Ch's 2, 3, and 4 the next preferred in that order. Ch 10 is the analog BSI channel. All channels are allowed to act as data channels (AVL/GPS being the most common usage).
ASTRO 25 systems will keep the control channel on the most preferred channel forever, until/unless that channel can no longer function properly. Literally forever, they do not rotate regularly as they did with 3600 systems. Note that with a simulcast cell, a channel failure at one subsite takes the channel out of service for the entire cell, in order to maintain the integrity of the simulcast.
If something happens with Ch 1 (repeater failure, illegal carrier, etc.), the system will roll to Ch 2. If Ch 2 is unusable, to Ch 3, and so on. Note that once the hardware condition is rectified with Ch 1, or the illegal carrier clears, the site will roll back to that channel as soon as possible. Normally the site will wait a minimum of 60 seconds before rolling back to the most preferred, even if the condition clears sooner than that, to provide some stability for the subscribers. If the condition on Ch 1 clears while control is on Ch 2, and before that 60 seconds expires, Ch 1 can be used for voice/data traffic if necessary. Once Ch 1 is clear and functional again, control rolls back to it.
When the site gets near capacity, it will first start to use the inactive control capable channels for traffic, then will use the BSI channel when those three are in use, and finally subscribers will get a system busy bonk due to lack of channel resources. Of course if this is a TDMA system, all slots of all channels would need to be in use before that happens. If one of the channels is carrying FDMA data as the site nears capacity, the data gets preempted by voice traffic.
If the site is at full saturation when the control channel fails, voice transmissions will be allowed to complete, and idle subscribers will likely get an Out of Range or Failsoft message (depending on how the system/site is setup), as there would be no control channel on the air at that point. If this is a multi-site system, those subscribers may try to roam to another site. Once the first voice transmission is complete on any of the other control-capable channels, the system will roll control over to that channel. So yes, it's certainly possible to lose all control channel functionality for a period of time. Hopefully the system/site was designed better to prevent that level of saturation and failure, but stuff happens in the real world.