2 files changed, 35 insertions, 4 deletions
diff --git a/makima/src/server/handlers/directives.rs b/makima/src/server/handlers/directives.rs
index 960da94..15df6d5 100644
--- a/makima/src/server/handlers/directives.rs
+++ b/makima/src/server/handlers/directives.rs
@@ -1063,7 +1063,7 @@ pub async fn pick_up_orders(
         };
 
     // Fetch available orders
-    let orders = match repository::get_available_orders_for_pickup(pool, auth.owner_id).await {
+    let orders = match repository::get_available_orders_for_pickup(pool, auth.owner_id, id).await {
         Ok(o) => o,
         Err(e) => {
             tracing::error!("Failed to fetch available orders: {}", e);
@@ -1078,7 +1078,7 @@ pub async fn pick_up_orders(
     // If no orders available, return early
     if orders.is_empty() {
         return Json(PickUpOrdersResponse {
-            message: "No orders available to pick up".to_string(),
+            message: "No orders available to plan".to_string(),
             order_count: 0,
             task_id: None,
         })
@@ -1125,6 +1125,13 @@ pub async fn pick_up_orders(
             .into_response();
     }
 
+    // Mark picked-up orders as in_progress
+    if let Err(e) =
+        repository::bulk_update_order_status(pool, auth.owner_id, &order_ids, "in_progress").await
+    {
+        tracing::warn!("Failed to update order status to in_progress: {}", e);
+    }
+
     // Create the planning task
     let req = CreateTaskRequest {
         contract_id: None,
@@ -1199,7 +1206,7 @@ pub async fn pick_up_orders(
     let _ = repository::advance_directive_ready_steps(pool, id).await;
 
     Json(PickUpOrdersResponse {
-        message: format!("Picked up {} orders", order_count),
+        message: format!("Planning {} orders", order_count),
         order_count,
         task_id: Some(task.id),
     })
diff --git a/makima/src/server/handlers/orders.rs b/makima/src/server/handlers/orders.rs
index cddf6a6..1251f79 100644
--- a/makima/src/server/handlers/orders.rs
+++ b/makima/src/server/handlers/orders.rs
@@ -81,13 +81,14 @@ pub async fn list_orders(
     }
 }
 
-/// Create a new order.
+/// Create a new order. A valid directive_id is required.
 #[utoipa::path(
     post,
     path = "/api/v1/orders",
     request_body = CreateOrderRequest,
     responses(
         (status = 201, description = "Order created", body = Order),
+        (status = 400, description = "Invalid directive_id", body = ApiError),
         (status = 401, description = "Unauthorized", body = ApiError),
         (status = 503, description = "Database not configured", body = ApiError),
     ),
@@ -107,6 +108,29 @@ pub async fn create_order(
             .into_response();
     };
 
+    // Validate the directive exists and belongs to this owner.
+    // directive_id is required by the CreateOrderRequest struct (Uuid, not Option<Uuid>).
+    match repository::get_directive_for_owner(pool, auth.owner_id, req.directive_id).await {
+        Ok(Some(_)) => {}
+        Ok(None) => {
+            return (
+                StatusCode::BAD_REQUEST,
+                Json(ApiError::new(
+                    "INVALID_DIRECTIVE",
+                    "directive_id is required and must reference a valid directive owned by you",
+                )),
+            )
+                .into_response();
+        }
+        Err(e) => {
+            return (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                Json(ApiError::new("VALIDATION_FAILED", &e.to_string())),
+            )
+                .into_response();
+        }
+    }
+
     match repository::create_order(pool, auth.owner_id, req).await {
         Ok(order) => (StatusCode::CREATED, Json(order)).into_response(),
         Err(e) => {