refactor(ttp): extract RuleIndex from RuleEngine

E.3.9.0 prerequisite for the per-source lifters (E.3.9-E.3.13). The
dispatch index, install/evict/apply_change atomic-swap protocol, and
state-modulation helpers (is_active / apply_ceiling) move out of
rule_engine.py into _rule_index.py and _state.py. RuleEngine wraps a
RuleIndex; back-compat shims preserve _by_kind / _by_rule / _install
attribute access for tests poking at the dispatch internals.

Lifters in E.3.9-E.3.12 will each hold their own RuleIndex, watching
the same RuleStore via subscribe_changes() fan-out. Hot-reload
semantics (disable / clip / TTL via set_state API) now reach
lifter-bound rules through the same atomic-swap path the engine uses,
not a future composite-rebuild compromise.

decnet/ttp/impl/_state.py

@@ -0,0 +1,55 @@
+"""Shared state-modulation helpers for rule consumers.
+
+Both :class:`~decnet.ttp.impl.rule_engine.RuleEngine` and the per-source
+lifters (E.3.9 onward) read :class:`~decnet.ttp.store.base.RuleState`
+the same way: skip on ``disabled``, defense-in-depth re-check
+``expires_at``, clamp confidence on ``clipped``. Single source of truth
+so a future change to the state contract lands in one place.
+"""
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from decnet.ttp.store.base import RuleState
+
+
+def is_active(state: "RuleState") -> bool:
+    """Return ``True`` iff a rule with this state is allowed to fire.
+
+    ``disabled`` rules never fire. ``clipped`` rules still fire — the
+    clip caps emitted confidence, doesn't suppress the emit. Expired
+    states act as ``disabled`` even though the store auto-reverts; the
+    re-check here is defense-in-depth against a racing read between
+    expiry and the store's revert pass.
+    """
+    if state.state == "disabled":
+        return False
+    if state.expires_at is not None:
+        expires = state.expires_at
+        if expires.tzinfo is None:
+            expires = expires.replace(tzinfo=timezone.utc)
+        if expires < datetime.now(tz=timezone.utc):
+            return False
+    return True
+
+
+def apply_ceiling(base: float, state: "RuleState") -> float:
+    """Apply the operator's confidence ceiling, downward only.
+
+    A ``clipped`` state with ``confidence_max < 1.0`` clamps the emitted
+    confidence to ``min(base, base * ceiling)``. Any other state is a
+    no-op. The clamp is downward by construction — operator clips can
+    never raise a rule's confidence above its YAML-declared base, per
+    TTP_TAGGING.md §"Confidence model".
+    """
+    if state.state != "clipped":
+        return base
+    ceiling = state.confidence_max
+    if ceiling is None or ceiling >= 1.0:
+        return base
+    return min(base, base * ceiling)
+
+
+__all__ = ["is_active", "apply_ceiling"]