Feature 094 (E4) — the pure focus model: a deterministic single tab order derived purely from `AccessibilityMetadata`, keyboard traversal over that order, and classification of a delivered key against the focused control's `KeyboardOperation`. Pure, total, deterministic — no I/O, no live window, property-testable to >=1000 generated combinations (SC-006). The `ControlId`<->`RetainedId` binding lives at the host seam (`Controls.Elmish.routeFocusedKey`), so `RetainedId` is absent here (R4). One focusable stop in the computed tab order, derived purely from AccessibilityMetadata.