diff --git a/_docs/02_tasks/todo/AZ-450_refactor_tile_urls.md b/_docs/02_tasks/done/AZ-450_refactor_tile_urls.md
similarity index 100%
rename from _docs/02_tasks/todo/AZ-450_refactor_tile_urls.md
rename to _docs/02_tasks/done/AZ-450_refactor_tile_urls.md
diff --git a/_docs/02_tasks/todo/AZ-451_refactor_leaflet_marker_icon.md b/_docs/02_tasks/done/AZ-451_refactor_leaflet_marker_icon.md
similarity index 100%
rename from _docs/02_tasks/todo/AZ-451_refactor_leaflet_marker_icon.md
rename to _docs/02_tasks/done/AZ-451_refactor_leaflet_marker_icon.md
diff --git a/_docs/02_tasks/todo/AZ-452_refactor_api_base_accessor.md b/_docs/02_tasks/done/AZ-452_refactor_api_base_accessor.md
similarity index 100%
rename from _docs/02_tasks/todo/AZ-452_refactor_api_base_accessor.md
rename to _docs/02_tasks/done/AZ-452_refactor_api_base_accessor.md
diff --git a/_docs/02_tasks/todo/AZ-454_refactor_document_token_accessor.md b/_docs/02_tasks/done/AZ-454_refactor_document_token_accessor.md
similarity index 100%
rename from _docs/02_tasks/todo/AZ-454_refactor_document_token_accessor.md
rename to _docs/02_tasks/done/AZ-454_refactor_document_token_accessor.md
diff --git a/_docs/_autodev_state.md b/_docs/_autodev_state.md
index b0814be..62b659e 100644
--- a/_docs/_autodev_state.md
+++ b/_docs/_autodev_state.md
@@ -6,9 +6,9 @@ step: 4
 name: Code Testability Revision
 status: in_progress
 sub_step:
-  phase: 2
-  name: refactor-phase-2-tasks-review-gate
-  detail: "epic AZ-447 + 7 tasks AZ-448..AZ-454 created"
+  phase: 4
+  name: refactor-phase-4-implement
+  detail: "batch 2 of 2 — AZ-448, AZ-449, AZ-453"
 retry_count: 0
 cycle: 1
 step_4_5_glossary_vision: confirmed
diff --git a/src/api/client.ts b/src/api/client.ts
index 21048f3..1d04a84 100644
--- a/src/api/client.ts
+++ b/src/api/client.ts
@@ -36,6 +36,21 @@ export function getApiBase(): string {
   return raw.replace(/\/+$/, '')
 }
 
+/**
+ * Indirection for the failed-refresh redirect. Default impl writes
+ * `'/login'` to `window.location.href` — the production behavior. Tests
+ * override via {@link setNavigateToLogin} to assert "redirect was invoked"
+ * without globally stubbing `window.location`. Must be reset by the test
+ * harness in teardown (see `_docs/02_document/tests/test-data.md`).
+ */
+let navigateToLoginImpl: () => void = () => {
+  window.location.href = '/login'
+}
+
+export function setNavigateToLogin(fn: () => void) {
+  navigateToLoginImpl = fn
+}
+
 async function handleResponse<T>(res: Response): Promise<T> {
   if (res.status === 204) return undefined as T
   if (!res.ok) {
@@ -60,7 +75,7 @@ async function request<T>(url: string, options: RequestInit = {}): Promise<T> {
       res = await fetch(fullUrl, { ...options, headers })
     } else {
       setToken(null)
-      window.location.href = '/login'
+      navigateToLoginImpl()
       throw new Error('Session expired')
     }
   }
diff --git a/src/features/flights/flightPlanUtils.ts b/src/features/flights/flightPlanUtils.ts
index 59c47e9..c7282b6 100644
--- a/src/features/flights/flightPlanUtils.ts
+++ b/src/features/flights/flightPlanUtils.ts
@@ -56,9 +56,18 @@ export function calculateDistance(
   return ascentVertical + horizontalDistance + descentVertical
 }
 
+const DEFAULT_OWM_BASE_URL = 'https://api.openweathermap.org/data/2.5'
+
+function getOwmBaseUrl(): string {
+  const raw = import.meta.env.VITE_OWM_BASE_URL
+  if (!raw) return DEFAULT_OWM_BASE_URL
+  return raw.replace(/\/+$/, '')
+}
+
 export async function getWeatherData(lat: number, lon: number) {
-  const apiKey = '335799082893fad97fa36118b131f919'
-  const url = `https://api.openweathermap.org/data/2.5/weather?lat=${lat}&lon=${lon}&appid=${apiKey}&units=metric`
+  const apiKey = import.meta.env.VITE_OWM_API_KEY
+  if (!apiKey) return null
+  const url = `${getOwmBaseUrl()}/weather?lat=${lat}&lon=${lon}&appid=${apiKey}&units=metric`
   try {
     const res = await fetch(url)
     const data = await res.json()