I am thinking it has to be two parts: 1. A workflow on the child record to lock 2. A user event script on the parent, probably before load that calls the child lock workflow