From 0b5723b77759190cda3a06531ba3ab9e3ba9e1d9 Mon Sep 17 00:00:00 2001
From: Joseph Doherty <dohejw01@gmail.com>
Date: Thu, 21 May 2026 18:38:02 -0400
Subject: [PATCH] feat(centralui): ParentExecutionId column, filter and parent
 drill-in on the Audit Log page

---
 .../Audit/AuditExportEndpoints.cs             |  8 ++
 .../Audit/AuditDrilldownDrawer.razor          | 11 +++
 .../Audit/AuditDrilldownDrawer.razor.cs       | 20 ++++-
 .../Components/Audit/AuditFilterBar.razor     | 10 +++
 .../Components/Audit/AuditFilterBar.razor.cs  |  1 +
 .../Components/Audit/AuditQueryModel.cs       | 15 ++++
 .../Components/Audit/AuditResultsGrid.razor   | 12 +++
 .../Audit/AuditResultsGrid.razor.cs           |  4 +-
 .../Pages/Audit/AuditLogPage.razor.cs         | 23 +++++-
 .../Audit/AuditDataSeeder.cs                  |  6 +-
 .../Audit/AuditLogPageTests.cs                | 79 +++++++++++++++++++
 .../Audit/AuditExportEndpointsTests.cs        | 23 ++++++
 .../Audit/AuditDrilldownDrawerTests.cs        | 45 +++++++++++
 .../Components/Audit/AuditFilterBarTests.cs   | 37 +++++++++
 .../Components/Audit/AuditResultsGridTests.cs | 49 +++++++++++-
 .../Pages/AuditLogPageExportUrlTests.cs       | 14 ++++
 .../Pages/AuditLogPageScaffoldTests.cs        | 39 +++++++++
 17 files changed, 387 insertions(+), 9 deletions(-)

diff --git a/src/ScadaLink.CentralUI/Audit/AuditExportEndpoints.cs b/src/ScadaLink.CentralUI/Audit/AuditExportEndpoints.cs
index 70b2bc3..a497dcb 100644
--- a/src/ScadaLink.CentralUI/Audit/AuditExportEndpoints.cs
+++ b/src/ScadaLink.CentralUI/Audit/AuditExportEndpoints.cs
@@ -112,6 +112,13 @@ public static class AuditExportEndpoints
             executionId = parsedExec;
         }
 
+        Guid? parentExecutionId = null;
+        if (query.TryGetValue("parentExecutionId", out var parentExecValues)
+            && Guid.TryParse(parentExecValues.ToString(), out var parsedParentExec))
+        {
+            parentExecutionId = parsedParentExec;
+        }
+
         DateTime? fromUtc = ParseUtcDate(query, "from");
         DateTime? toUtc = ParseUtcDate(query, "to");
 
@@ -124,6 +131,7 @@ public static class AuditExportEndpoints
             Actor: actor,
             CorrelationId: correlationId,
             ExecutionId: executionId,
+            ParentExecutionId: parentExecutionId,
             FromUtc: fromUtc,
             ToUtc: toUtc);
     }
diff --git a/src/ScadaLink.CentralUI/Components/Audit/AuditDrilldownDrawer.razor b/src/ScadaLink.CentralUI/Components/Audit/AuditDrilldownDrawer.razor
index ff31789..1c3ea16 100644
--- a/src/ScadaLink.CentralUI/Components/Audit/AuditDrilldownDrawer.razor
+++ b/src/ScadaLink.CentralUI/Components/Audit/AuditDrilldownDrawer.razor
@@ -58,6 +58,9 @@
                 <dt class="col-4 text-muted fw-normal">ExecutionId</dt>
                 <dd class="col-8 font-monospace" data-test="field-ExecutionId">@(Event.ExecutionId?.ToString() ?? "—")</dd>
 
+                <dt class="col-4 text-muted fw-normal">ParentExecutionId</dt>
+                <dd class="col-8 font-monospace" data-test="field-ParentExecutionId">@(Event.ParentExecutionId?.ToString() ?? "—")</dd>
+
                 <dt class="col-4 text-muted fw-normal">OccurredAtUtc</dt>
                 <dd class="col-8 font-monospace" data-test="field-OccurredAtUtc">@FormatTimestamp(Event.OccurredAtUtc)</dd>
 
@@ -162,6 +165,14 @@
                     View this execution
                 </button>
             }
+            @if (Event.ParentExecutionId is not null)
+            {
+                <button class="btn btn-outline-secondary btn-sm"
+                        data-test="view-parent-execution"
+                        @onclick="ViewParentExecution">
+                    View parent execution
+                </button>
+            }
             <button class="btn btn-primary btn-sm ms-auto"
                     data-test="drawer-close-footer"
                     @onclick="HandleClose">
diff --git a/src/ScadaLink.CentralUI/Components/Audit/AuditDrilldownDrawer.razor.cs b/src/ScadaLink.CentralUI/Components/Audit/AuditDrilldownDrawer.razor.cs
index 389e1ef..8c08bc3 100644
--- a/src/ScadaLink.CentralUI/Components/Audit/AuditDrilldownDrawer.razor.cs
+++ b/src/ScadaLink.CentralUI/Components/Audit/AuditDrilldownDrawer.razor.cs
@@ -49,7 +49,10 @@ namespace ScadaLink.CentralUI.Components.Audit;
 /// the "Show all events" button navigates to
 /// <c>/audit/log?correlationId={id}</c>. Likewise, when
 /// <see cref="AuditEvent.ExecutionId"/> is set the "View this execution"
-/// button navigates to <c>/audit/log?executionId={id}</c>. Both are deep
+/// button navigates to <c>/audit/log?executionId={id}</c>. Likewise, when
+/// <see cref="AuditEvent.ParentExecutionId"/> is set the "View parent
+/// execution" button navigates to <c>/audit/log?executionId={parentId}</c>
+/// — the spawner's id used as the per-run drill-in target. All are deep
 /// links the Audit Log page deserializes on init (Bundle D) and auto-loads.
 /// </para>
 /// </summary>
@@ -291,6 +294,21 @@ public partial class AuditDrilldownDrawer
         Navigation.NavigateTo(uri);
     }
 
+    /// <summary>
+    /// Drill-in to the spawner execution: a routed (child) row carries a non-null
+    /// <see cref="AuditEvent.ParentExecutionId"/>. Navigates to
+    /// <c>/audit/log?executionId={ParentExecutionId}</c> so the user sees the
+    /// spawner execution's own rows — the parent's id becomes the <c>?executionId=</c>
+    /// drill-in target. The button is only rendered when
+    /// <see cref="AuditEvent.ParentExecutionId"/> is non-null, so this is total.
+    /// </summary>
+    private void ViewParentExecution()
+    {
+        if (Event?.ParentExecutionId is not { } parentExec) return;
+        var uri = $"/audit/log?executionId={parentExec}";
+        Navigation.NavigateTo(uri);
+    }
+
     /// <summary>
     /// Build a cURL command from an audit event. The URL comes from
     /// <c>Target</c>; when the RequestSummary parses as
diff --git a/src/ScadaLink.CentralUI/Components/Audit/AuditFilterBar.razor b/src/ScadaLink.CentralUI/Components/Audit/AuditFilterBar.razor
index 6d4bb29..0c06025 100644
--- a/src/ScadaLink.CentralUI/Components/Audit/AuditFilterBar.razor
+++ b/src/ScadaLink.CentralUI/Components/Audit/AuditFilterBar.razor
@@ -127,6 +127,16 @@
                        placeholder="paste GUID…" @bind="_model.ExecutionId" />
             </div>
 
+            @* ParentExecutionId is an exact-match Guid filter — the operator pastes
+               the spawner execution's id to find every run it spawned. Lax-parsed
+               in ToFilter, exactly like ExecutionId above. *@
+            <div class="col-auto" data-test="filter-parent-execution-id">
+                <label class="form-label small mb-1" for="audit-parent-execution-id">Parent execution ID</label>
+                <input id="audit-parent-execution-id" type="text"
+                       class="form-control form-control-sm font-monospace"
+                       placeholder="paste GUID…" @bind="_model.ParentExecutionId" />
+            </div>
+
             <div class="col-auto" data-test="filter-errors-only">
                 <div class="form-check mb-1">
                     <input class="form-check-input" type="checkbox" id="audit-errors-only"
diff --git a/src/ScadaLink.CentralUI/Components/Audit/AuditFilterBar.razor.cs b/src/ScadaLink.CentralUI/Components/Audit/AuditFilterBar.razor.cs
index 9333ca4..f7d6d16 100644
--- a/src/ScadaLink.CentralUI/Components/Audit/AuditFilterBar.razor.cs
+++ b/src/ScadaLink.CentralUI/Components/Audit/AuditFilterBar.razor.cs
@@ -136,6 +136,7 @@ public partial class AuditFilterBar
         _model.TargetSearch = string.Empty;
         _model.ActorSearch = string.Empty;
         _model.ExecutionId = string.Empty;
+        _model.ParentExecutionId = string.Empty;
         _model.ErrorsOnly = false;
     }
 
diff --git a/src/ScadaLink.CentralUI/Components/Audit/AuditQueryModel.cs b/src/ScadaLink.CentralUI/Components/Audit/AuditQueryModel.cs
index db1056b..a880c0d 100644
--- a/src/ScadaLink.CentralUI/Components/Audit/AuditQueryModel.cs
+++ b/src/ScadaLink.CentralUI/Components/Audit/AuditQueryModel.cs
@@ -55,6 +55,15 @@ public sealed class AuditQueryModel
     /// </summary>
     public string ExecutionId { get; set; } = string.Empty;
 
+    /// <summary>
+    /// Paste-in ParentExecutionId filter — the operator pastes the spawner
+    /// execution's Guid to find every run it spawned. Stored as free text;
+    /// <see cref="ToFilter"/> lax-parses it through
+    /// <see cref="Guid.TryParse(string?, out Guid)"/> so a blank or unparseable
+    /// value simply yields no constraint, mirroring <see cref="ExecutionId"/>.
+    /// </summary>
+    public string ParentExecutionId { get; set; } = string.Empty;
+
     public bool ErrorsOnly { get; set; }
 
     /// <summary>
@@ -128,6 +137,11 @@ public sealed class AuditQueryModel
             ? parsedExecutionId
             : null;
 
+        // Same lax-parse contract for the pasted ParentExecutionId.
+        Guid? parentExecutionId = Guid.TryParse(ParentExecutionId, out var parsedParentExecutionId)
+            ? parsedParentExecutionId
+            : null;
+
         return new AuditLogQueryFilter(
             Channels: Channels.Count > 0 ? Channels.ToArray() : null,
             Kinds: Kinds.Count > 0 ? Kinds.ToArray() : null,
@@ -137,6 +151,7 @@ public sealed class AuditQueryModel
             Actor: string.IsNullOrWhiteSpace(ActorSearch) ? null : ActorSearch.Trim(),
             CorrelationId: null,
             ExecutionId: executionId,
+            ParentExecutionId: parentExecutionId,
             FromUtc: fromUtc,
             ToUtc: toUtc);
     }
diff --git a/src/ScadaLink.CentralUI/Components/Audit/AuditResultsGrid.razor b/src/ScadaLink.CentralUI/Components/Audit/AuditResultsGrid.razor
index 2e5c692..cde0f35 100644
--- a/src/ScadaLink.CentralUI/Components/Audit/AuditResultsGrid.razor
+++ b/src/ScadaLink.CentralUI/Components/Audit/AuditResultsGrid.razor
@@ -132,6 +132,18 @@
                     <span class="small text-muted">—</span>
                 }
                 break;
+            case "ParentExecutionId":
+                @if (row.ParentExecutionId is { } parentExecutionId)
+                {
+                    <span class="small font-monospace"
+                          data-test="parent-execution-id-@row.EventId"
+                          title="@parentExecutionId">@ShortGuid(parentExecutionId)</span>
+                }
+                else
+                {
+                    <span class="small text-muted">—</span>
+                }
+                break;
             case "DurationMs":
                 <span class="small font-monospace">@(row.DurationMs?.ToString() ?? "—")</span>
                 break;
diff --git a/src/ScadaLink.CentralUI/Components/Audit/AuditResultsGrid.razor.cs b/src/ScadaLink.CentralUI/Components/Audit/AuditResultsGrid.razor.cs
index 1303628..94c9611 100644
--- a/src/ScadaLink.CentralUI/Components/Audit/AuditResultsGrid.razor.cs
+++ b/src/ScadaLink.CentralUI/Components/Audit/AuditResultsGrid.razor.cs
@@ -11,7 +11,8 @@ namespace ScadaLink.CentralUI.Components.Audit;
 /// Keyset-paged results grid for the central Audit Log page (#23 M7-T3).
 /// Renders the columns named in Component-AuditLog.md §10 — OccurredAtUtc,
 /// Site, Channel, Kind, Status, Target, Actor, DurationMs, HttpStatus,
-/// ErrorMessage — plus the ExecutionId per-run correlation column. Talks to
+/// ErrorMessage — plus the ExecutionId per-run correlation column and the
+/// ParentExecutionId spawner-correlation column. Talks to
 /// <see cref="Services.IAuditLogQueryService"/>
 /// — never to <c>IAuditLogRepository</c> directly — so tests can stub the data
 /// source without standing up EF Core.
@@ -123,6 +124,7 @@ public partial class AuditResultsGrid : IAsyncDisposable
         ("Target", "Target"),
         ("Actor", "Actor"),
         ("ExecutionId", "ExecutionId"),
+        ("ParentExecutionId", "ParentExecutionId"),
         ("DurationMs", "DurationMs"),
         ("HttpStatus", "HttpStatus"),
         ("ErrorMessage", "ErrorMessage"),
diff --git a/src/ScadaLink.CentralUI/Components/Pages/Audit/AuditLogPage.razor.cs b/src/ScadaLink.CentralUI/Components/Pages/Audit/AuditLogPage.razor.cs
index 9fb1d42..56a1227 100644
--- a/src/ScadaLink.CentralUI/Components/Pages/Audit/AuditLogPage.razor.cs
+++ b/src/ScadaLink.CentralUI/Components/Pages/Audit/AuditLogPage.razor.cs
@@ -23,7 +23,9 @@ namespace ScadaLink.CentralUI.Components.Pages.Audit;
 /// <c>?instance=</c> are read on initialization. Bundle E (M7-T13) extends
 /// this with <c>?status=</c> so the Health-dashboard Audit error-rate tile can
 /// drill in to <c>?status=Failed</c>. The ExecutionId follow-up adds
-/// <c>?executionId=</c> for the "View this execution" drill-in. When any param is present we allocate a
+/// <c>?executionId=</c> for the "View this execution" drill-in, and the
+/// ParentExecutionId follow-up adds <c>?parentExecutionId=</c> for the
+/// "View parent execution" drill-in. When any param is present we allocate a
 /// fresh <see cref="AuditLogQueryFilter"/> and assign it to
 /// <see cref="_currentFilter"/>, which kicks the results grid into auto-load
 /// without the user clicking Apply. Unknown values (e.g. an invalid enum name)
@@ -71,6 +73,15 @@ public partial class AuditLogPage
             executionId = parsedExec;
         }
 
+        // ?parentExecutionId= constrains to runs spawned by a given execution.
+        // Lax-parsed like ?executionId=: an unparseable value is silently dropped.
+        Guid? parentExecutionId = null;
+        if (query.TryGetValue("parentExecutionId", out var parentExecValues)
+            && Guid.TryParse(parentExecValues.ToString(), out var parsedParentExec))
+        {
+            parentExecutionId = parsedParentExec;
+        }
+
         string? target = null;
         if (query.TryGetValue("target", out var targetValues))
         {
@@ -128,7 +139,8 @@ public partial class AuditLogPage
         // auto-loads. Pure ?instance= deep links (UI-only) do not trigger auto-load
         // because the filter contract has no instance column — the user still needs
         // to refine + Apply for those.
-        if (correlationId is null && executionId is null && target is null && actor is null
+        if (correlationId is null && executionId is null && parentExecutionId is null
+            && target is null && actor is null
             && sites is null && channels is null && kinds is null && statuses is null)
         {
             return;
@@ -142,7 +154,8 @@ public partial class AuditLogPage
             Target: target,
             Actor: actor,
             CorrelationId: correlationId,
-            ExecutionId: executionId);
+            ExecutionId: executionId,
+            ParentExecutionId: parentExecutionId);
     }
 
     /// <summary>
@@ -252,6 +265,10 @@ public partial class AuditLogPage
         {
             parts.Add(new("executionId", exec.ToString()));
         }
+        if (filter.ParentExecutionId is { } parentExec)
+        {
+            parts.Add(new("parentExecutionId", parentExec.ToString()));
+        }
         if (filter.FromUtc is { } from)
         {
             parts.Add(new("from", from.ToString("O", CultureInfo.InvariantCulture)));
diff --git a/tests/ScadaLink.CentralUI.PlaywrightTests/Audit/AuditDataSeeder.cs b/tests/ScadaLink.CentralUI.PlaywrightTests/Audit/AuditDataSeeder.cs
index 4c2480d..0edcd95 100644
--- a/tests/ScadaLink.CentralUI.PlaywrightTests/Audit/AuditDataSeeder.cs
+++ b/tests/ScadaLink.CentralUI.PlaywrightTests/Audit/AuditDataSeeder.cs
@@ -66,6 +66,7 @@ internal static class AuditDataSeeder
         string? actor = null,
         Guid? correlationId = null,
         Guid? executionId = null,
+        Guid? parentExecutionId = null,
         int? httpStatus = null,
         int? durationMs = null,
         string? errorMessage = null,
@@ -77,12 +78,12 @@ internal static class AuditDataSeeder
         const string sql = @"
 INSERT INTO [AuditLog]
 ([EventId], [OccurredAtUtc], [IngestedAtUtc], [Channel], [Kind], [CorrelationId],
- [ExecutionId], [SourceSiteId], [SourceInstanceId], [SourceScript], [Actor], [Target],
+ [ExecutionId], [ParentExecutionId], [SourceSiteId], [SourceInstanceId], [SourceScript], [Actor], [Target],
  [Status], [HttpStatus], [DurationMs], [ErrorMessage], [ErrorDetail], [RequestSummary],
  [ResponseSummary], [PayloadTruncated], [Extra], [ForwardState])
 VALUES
 (@eventId, @occurredAtUtc, SYSUTCDATETIME(), @channel, @kind, @correlationId,
- @executionId, @sourceSiteId, NULL, NULL, @actor, @target,
+ @executionId, @parentExecutionId, @sourceSiteId, NULL, NULL, @actor, @target,
  @status, @httpStatus, @durationMs, @errorMessage, NULL, @requestSummary,
  @responseSummary, 0, @extra, NULL);";
 
@@ -96,6 +97,7 @@ VALUES
         cmd.Parameters.AddWithValue("@kind", kind);
         cmd.Parameters.AddWithValue("@correlationId", (object?)correlationId ?? DBNull.Value);
         cmd.Parameters.AddWithValue("@executionId", (object?)executionId ?? DBNull.Value);
+        cmd.Parameters.AddWithValue("@parentExecutionId", (object?)parentExecutionId ?? DBNull.Value);
         cmd.Parameters.AddWithValue("@sourceSiteId", (object?)sourceSiteId ?? DBNull.Value);
         cmd.Parameters.AddWithValue("@actor", (object?)actor ?? DBNull.Value);
         cmd.Parameters.AddWithValue("@target", (object?)target ?? DBNull.Value);
diff --git a/tests/ScadaLink.CentralUI.PlaywrightTests/Audit/AuditLogPageTests.cs b/tests/ScadaLink.CentralUI.PlaywrightTests/Audit/AuditLogPageTests.cs
index f066cdb..4fefe5d 100644
--- a/tests/ScadaLink.CentralUI.PlaywrightTests/Audit/AuditLogPageTests.cs
+++ b/tests/ScadaLink.CentralUI.PlaywrightTests/Audit/AuditLogPageTests.cs
@@ -27,6 +27,10 @@ namespace ScadaLink.CentralUI.PlaywrightTests.Audit;
 ///   <item><c>DrillInFromExecutionId_LandsOnAuditLogWithFilterContext</c> — the
 ///   <c>?executionId=</c> drill-in (the drawer's "View this execution" action)
 ///   auto-loads the grid filtered by ExecutionId.</item>
+///   <item><c>DrillInFromParentExecution_FiltersGridToSpawnerExecution</c> — the
+///   drawer's "View parent execution" action on a spawned (child) row drills in
+///   to <c>?executionId={ParentExecutionId}</c>, auto-loading the spawner's
+///   rows.</item>
 ///   <item><c>NotificationsPage_HasViewAuditHistoryLink_WhenNotificationsExist</c> —
 ///   the report page wires drill-in links when notifications are present.</item>
 ///   <item><c>ExportCsv_LinkIsVisibleAndDownloads</c> — Export CSV button gated on
@@ -350,6 +354,81 @@ public class AuditLogPageTests
         }
     }
 
+    [Fact]
+    public async Task DrillInFromParentExecution_FiltersGridToSpawnerExecution()
+    {
+        // The drawer's "View parent execution" action navigates a routed (child)
+        // row to /audit/log?executionId={ParentExecutionId}. We seed a spawner row
+        // (its ExecutionId == the parent id) and a child row (ParentExecutionId
+        // pointing at the spawner), open the child's drawer, click the action, and
+        // assert the grid auto-loads filtered to the spawner's own rows.
+        if (!await AuditDataSeeder.IsAvailableAsync())
+        {
+            throw new InvalidOperationException("MSSQL unavailable; see FilterNarrowing test for setup instructions.");
+        }
+
+        var runId = Guid.NewGuid().ToString("N");
+        var targetPrefix = $"playwright-test/parent-exec-drill-in/{runId}/";
+        var parentExecutionId = Guid.NewGuid();
+        var spawnerEventId = Guid.NewGuid();
+        var childEventId = Guid.NewGuid();
+        var now = DateTime.UtcNow;
+
+        try
+        {
+            // The spawner execution's own row — carries ExecutionId == parentExecutionId.
+            await AuditDataSeeder.InsertAuditEventAsync(
+                eventId: spawnerEventId,
+                occurredAtUtc: now,
+                channel: "ApiInbound",
+                kind: "InboundRequest",
+                status: "Delivered",
+                target: targetPrefix + "spawner",
+                executionId: parentExecutionId,
+                httpStatus: 200,
+                durationMs: 7);
+
+            // The child (spawned) row — ParentExecutionId points at the spawner.
+            await AuditDataSeeder.InsertAuditEventAsync(
+                eventId: childEventId,
+                occurredAtUtc: now,
+                channel: "ApiOutbound",
+                kind: "ApiCall",
+                status: "Delivered",
+                target: targetPrefix + "child",
+                executionId: Guid.NewGuid(),
+                parentExecutionId: parentExecutionId,
+                httpStatus: 200,
+                durationMs: 13);
+
+            var page = await _fixture.NewAuthenticatedPageAsync();
+
+            // Land on the child row via its ParentExecutionId filter, open the drawer.
+            await page.GotoAsync($"{PlaywrightFixture.BaseUrl}/audit/log?parentExecutionId={parentExecutionId}");
+            await page.WaitForLoadStateAsync(LoadState.NetworkIdle);
+
+            var childRow = page.Locator($"[data-test='grid-row-{childEventId}']");
+            await Assertions.Expect(childRow).ToBeVisibleAsync();
+            await childRow.ClickAsync();
+
+            // The "View parent execution" action drills in to the spawner.
+            var viewParent = page.Locator("[data-test='view-parent-execution']");
+            await Assertions.Expect(viewParent).ToBeVisibleAsync();
+            await viewParent.ClickAsync();
+            await page.WaitForLoadStateAsync(LoadState.NetworkIdle);
+
+            // The drill-in lands on ?executionId={parentExecutionId} and auto-loads
+            // the spawner's own row.
+            Assert.Contains($"executionId={parentExecutionId}", page.Url);
+            var spawnerRow = page.Locator($"[data-test='grid-row-{spawnerEventId}']");
+            await Assertions.Expect(spawnerRow).ToBeVisibleAsync();
+        }
+        finally
+        {
+            await AuditDataSeeder.DeleteByTargetPrefixAsync(targetPrefix);
+        }
+    }
+
     [Fact]
     public async Task NotificationsPage_RendersAuditDrillInLinkPattern()
     {
diff --git a/tests/ScadaLink.CentralUI.Tests/Audit/AuditExportEndpointsTests.cs b/tests/ScadaLink.CentralUI.Tests/Audit/AuditExportEndpointsTests.cs
index dcccf89..4f29c03 100644
--- a/tests/ScadaLink.CentralUI.Tests/Audit/AuditExportEndpointsTests.cs
+++ b/tests/ScadaLink.CentralUI.Tests/Audit/AuditExportEndpointsTests.cs
@@ -139,6 +139,7 @@ public class AuditExportEndpointsTests
         {
             var correlationId = Guid.NewGuid().ToString();
             var executionId = Guid.NewGuid().ToString();
+            var parentExecutionId = Guid.NewGuid().ToString();
             var url =
                 "/api/centralui/audit/export?" +
                 "channel=ApiOutbound&" +
@@ -149,6 +150,7 @@ public class AuditExportEndpointsTests
                 "actor=apikey-1&" +
                 $"correlationId={correlationId}&" +
                 $"executionId={executionId}&" +
+                $"parentExecutionId={parentExecutionId}&" +
                 "from=2026-05-20T00:00:00Z&" +
                 "to=2026-05-20T23:59:59Z";
 
@@ -170,6 +172,7 @@ public class AuditExportEndpointsTests
                     f.Actor == "apikey-1" &&
                     f.CorrelationId == Guid.Parse(correlationId) &&
                     f.ExecutionId == Guid.Parse(executionId) &&
+                    f.ParentExecutionId == Guid.Parse(parentExecutionId) &&
                     f.FromUtc == new DateTime(2026, 5, 20, 0, 0, 0, DateTimeKind.Utc) &&
                     f.ToUtc == new DateTime(2026, 5, 20, 23, 59, 59, DateTimeKind.Utc)),
                 Arg.Any<AuditLogPaging>(),
@@ -199,6 +202,7 @@ public class AuditExportEndpointsTests
                     f.Actor == null &&
                     f.CorrelationId == null &&
                     f.ExecutionId == null &&
+                    f.ParentExecutionId == null &&
                     f.FromUtc == null &&
                     f.ToUtc == null),
                 Arg.Any<AuditLogPaging>(),
@@ -245,6 +249,25 @@ public class AuditExportEndpointsTests
         }
     }
 
+    [Fact]
+    public async Task ExportEndpoint_UnparseableParentExecutionId_SilentlyDropped()
+    {
+        // Lax-parse contract: an unparseable parentExecutionId is dropped (no 400)
+        // — mirrors the executionId / correlationId parse.
+        var (client, repo, host) = await BuildHostAsync();
+        using (host)
+        {
+            var response = await client.GetAsync("/api/centralui/audit/export?parentExecutionId=not-a-guid");
+            Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+            _ = await response.Content.ReadAsStringAsync();
+
+            await repo.Received().QueryAsync(
+                Arg.Is<AuditLogQueryFilter>(f => f.ParentExecutionId == null),
+                Arg.Any<AuditLogPaging>(),
+                Arg.Any<CancellationToken>());
+        }
+    }
+
     /// <summary>
     /// Test-only authentication handler that signs every request in as an Admin.
     /// Admin is in <c>AuditExportRoles</c>, so the endpoint's AuditExport policy
diff --git a/tests/ScadaLink.CentralUI.Tests/Components/Audit/AuditDrilldownDrawerTests.cs b/tests/ScadaLink.CentralUI.Tests/Components/Audit/AuditDrilldownDrawerTests.cs
index b82d944..15bcf62 100644
--- a/tests/ScadaLink.CentralUI.Tests/Components/Audit/AuditDrilldownDrawerTests.cs
+++ b/tests/ScadaLink.CentralUI.Tests/Components/Audit/AuditDrilldownDrawerTests.cs
@@ -41,6 +41,7 @@ public class AuditDrilldownDrawerTests : BunitContext
         string? extra = null,
         Guid? correlationId = null,
         Guid? executionId = null,
+        Guid? parentExecutionId = null,
         string? errorMessage = null,
         string? errorDetail = null,
         string? target = "demo-target")
@@ -53,6 +54,7 @@ public class AuditDrilldownDrawerTests : BunitContext
             Kind = kind,
             CorrelationId = correlationId,
             ExecutionId = executionId,
+            ParentExecutionId = parentExecutionId,
             SourceSiteId = "plant-a",
             SourceInstanceId = "boiler-3",
             SourceScript = "OnAlarm.csx",
@@ -258,6 +260,49 @@ public class AuditDrilldownDrawerTests : BunitContext
         Assert.Contains($"/audit/log?executionId={exec}", nav.Uri);
     }
 
+    [Fact]
+    public void Drawer_NullParentExecutionId_HidesViewParentExecutionButton()
+    {
+        var ev = MakeEvent(parentExecutionId: null);
+
+        var cut = Render<AuditDrilldownDrawer>(p => p
+            .Add(c => c.Event, ev)
+            .Add(c => c.IsOpen, true));
+
+        Assert.DoesNotContain("data-test=\"view-parent-execution\"", cut.Markup);
+    }
+
+    [Fact]
+    public void Drawer_NonNullParentExecutionId_ShowsViewParentExecutionButton()
+    {
+        var ev = MakeEvent(parentExecutionId: Guid.Parse("bbbbbbbb-1111-2222-3333-444444444444"));
+
+        var cut = Render<AuditDrilldownDrawer>(p => p
+            .Add(c => c.Event, ev)
+            .Add(c => c.IsOpen, true));
+
+        Assert.Contains("data-test=\"view-parent-execution\"", cut.Markup);
+    }
+
+    [Fact]
+    public void ViewParentExecution_Navigates_WithExecutionIdQueryString()
+    {
+        // A routed (child) row drills in to its spawner: the "View parent
+        // execution" action navigates to /audit/log?executionId={ParentExecutionId}
+        // so the user sees the spawner execution's rows.
+        var parent = Guid.Parse("eeeeeeee-dddd-cccc-bbbb-aaaaaaaaaaaa");
+        var ev = MakeEvent(parentExecutionId: parent);
+
+        var cut = Render<AuditDrilldownDrawer>(p => p
+            .Add(c => c.Event, ev)
+            .Add(c => c.IsOpen, true));
+
+        cut.Find("[data-test=\"view-parent-execution\"]").Click();
+
+        var nav = (BunitNavigationManager)Services.GetRequiredService<NavigationManager>();
+        Assert.Contains($"/audit/log?executionId={parent}", nav.Uri);
+    }
+
     [Fact]
     public async Task CopyAsCurl_InvokesClipboard_WithCurlString()
     {
diff --git a/tests/ScadaLink.CentralUI.Tests/Components/Audit/AuditFilterBarTests.cs b/tests/ScadaLink.CentralUI.Tests/Components/Audit/AuditFilterBarTests.cs
index 3c3b202..d34fa3d 100644
--- a/tests/ScadaLink.CentralUI.Tests/Components/Audit/AuditFilterBarTests.cs
+++ b/tests/ScadaLink.CentralUI.Tests/Components/Audit/AuditFilterBarTests.cs
@@ -62,6 +62,7 @@ public class AuditFilterBarTests : BunitContext
             "data-test=\"filter-target\"",
             "data-test=\"filter-actor\"",
             "data-test=\"filter-execution-id\"",
+            "data-test=\"filter-parent-execution-id\"",
             "data-test=\"filter-errors-only\"",
         };
         foreach (var marker in markers)
@@ -215,6 +216,42 @@ public class AuditFilterBarTests : BunitContext
         Assert.Null(captured!.ExecutionId);
     }
 
+    [Fact]
+    public void Apply_WithPastedParentExecutionId_MapsThroughToFilter()
+    {
+        // The operator pastes a Guid into the Parent execution ID box; Apply must
+        // map it straight onto AuditLogQueryFilter.ParentExecutionId.
+        var parentExecutionId = Guid.Parse("11112222-3333-4444-5555-666677778888");
+        AuditLogQueryFilter? captured = null;
+        var cut = Render<AuditFilterBar>(p => p
+            .Add(c => c.OnFilterChanged, EventCallback.Factory.Create<AuditLogQueryFilter>(this, f => captured = f)));
+
+        cut.Find("[data-test=\"filter-parent-execution-id\"] input").Change(parentExecutionId.ToString());
+        cut.Find("[data-test=\"filter-apply\"]").Click();
+
+        Assert.NotNull(captured);
+        Assert.Equal(parentExecutionId, captured!.ParentExecutionId);
+    }
+
+    [Fact]
+    public void Apply_WithBlankOrUnparseableParentExecutionId_LeavesFilterParentExecutionIdNull()
+    {
+        // Lax parsing: a blank box yields no constraint; garbage text likewise.
+        AuditLogQueryFilter? captured = null;
+        var cut = Render<AuditFilterBar>(p => p
+            .Add(c => c.OnFilterChanged, EventCallback.Factory.Create<AuditLogQueryFilter>(this, f => captured = f)));
+
+        // Blank — never typed into.
+        cut.Find("[data-test=\"filter-apply\"]").Click();
+        Assert.NotNull(captured);
+        Assert.Null(captured!.ParentExecutionId);
+
+        // Unparseable paste — still dropped, no error.
+        cut.Find("[data-test=\"filter-parent-execution-id\"] input").Change("not-a-guid");
+        cut.Find("[data-test=\"filter-apply\"]").Click();
+        Assert.Null(captured!.ParentExecutionId);
+    }
+
     [Fact]
     public void TimeRange_LastHour_PopulatesFromUtc_ApproxOneHourAgo()
     {
diff --git a/tests/ScadaLink.CentralUI.Tests/Components/Audit/AuditResultsGridTests.cs b/tests/ScadaLink.CentralUI.Tests/Components/Audit/AuditResultsGridTests.cs
index 4ba39d5..a0549b2 100644
--- a/tests/ScadaLink.CentralUI.Tests/Components/Audit/AuditResultsGridTests.cs
+++ b/tests/ScadaLink.CentralUI.Tests/Components/Audit/AuditResultsGridTests.cs
@@ -22,7 +22,7 @@ public class AuditResultsGridTests : BunitContext
     private readonly IAuditLogQueryService _service;
     private readonly List<(AuditLogQueryFilter Filter, AuditLogPaging? Paging)> _calls = new();
 
-    private static AuditEvent MakeEvent(DateTime occurredAtUtc, AuditStatus status, AuditChannel channel = AuditChannel.ApiOutbound, AuditKind kind = AuditKind.ApiCall, string? site = "plant-a", Guid? executionId = null)
+    private static AuditEvent MakeEvent(DateTime occurredAtUtc, AuditStatus status, AuditChannel channel = AuditChannel.ApiOutbound, AuditKind kind = AuditKind.ApiCall, string? site = "plant-a", Guid? executionId = null, Guid? parentExecutionId = null)
         => new()
         {
             EventId = Guid.NewGuid(),
@@ -34,6 +34,7 @@ public class AuditResultsGridTests : BunitContext
             Target = "demo-target",
             Actor = "tester",
             ExecutionId = executionId,
+            ParentExecutionId = parentExecutionId,
             DurationMs = 42,
             HttpStatus = status == AuditStatus.Delivered ? 200 : 500,
             ErrorMessage = status == AuditStatus.Failed ? "boom — unreachable" : null,
@@ -165,6 +166,49 @@ public class AuditResultsGridTests : BunitContext
         Assert.Empty(cut.FindAll($"[data-test=\"execution-id-{row.EventId}\"]"));
     }
 
+    [Fact]
+    public void Render_IncludesParentExecutionIdColumn()
+    {
+        StubPage(new List<AuditEvent>
+        {
+            MakeEvent(DateTime.UtcNow.AddMinutes(-1), AuditStatus.Delivered),
+        });
+
+        var cut = Render<AuditResultsGrid>(p => p.Add(c => c.Filter, new AuditLogQueryFilter()));
+
+        // The ParentExecutionId column header is present alongside the spec columns.
+        Assert.Contains("data-test=\"col-header-ParentExecutionId\"", cut.Markup);
+    }
+
+    [Fact]
+    public void ParentExecutionId_NonNullRow_RendersShortMonospaceValue()
+    {
+        var parentExecutionId = Guid.Parse("fedcba98-2222-3333-4444-555555555555");
+        var row = MakeEvent(DateTime.UtcNow.AddMinutes(-1), AuditStatus.Delivered, parentExecutionId: parentExecutionId);
+        StubPage(new[] { row });
+
+        var cut = Render<AuditResultsGrid>(p => p.Add(c => c.Filter, new AuditLogQueryFilter()));
+
+        var cell = cut.Find($"[data-test=\"parent-execution-id-{row.EventId}\"]");
+        // Short form: first 8 hex digits of the "N" form — mirrors ExecutionId.
+        Assert.Equal("fedcba98", cell.TextContent.Trim());
+        // Monospace presentation; full value retained in the title attribute.
+        Assert.Contains("font-monospace", cell.GetAttribute("class") ?? string.Empty);
+        Assert.Equal(parentExecutionId.ToString(), cell.GetAttribute("title"));
+    }
+
+    [Fact]
+    public void ParentExecutionId_NullRow_RendersBlankPlaceholder_NoParentExecutionIdCell()
+    {
+        var row = MakeEvent(DateTime.UtcNow.AddMinutes(-1), AuditStatus.Delivered, parentExecutionId: null);
+        StubPage(new[] { row });
+
+        var cut = Render<AuditResultsGrid>(p => p.Add(c => c.Filter, new AuditLogQueryFilter()));
+
+        // A null ParentExecutionId renders the em-dash placeholder, not a value cell.
+        Assert.Empty(cut.FindAll($"[data-test=\"parent-execution-id-{row.EventId}\"]"));
+    }
+
     [Fact]
     public void Status_FailedRow_HasErrorBadgeClass()
     {
@@ -193,7 +237,8 @@ public class AuditResultsGridTests : BunitContext
     private static readonly string[] DefaultOrder =
     {
         "OccurredAtUtc", "Site", "Channel", "Kind", "Status",
-        "Target", "Actor", "DurationMs", "HttpStatus", "ErrorMessage",
+        "Target", "Actor", "ExecutionId", "ParentExecutionId",
+        "DurationMs", "HttpStatus", "ErrorMessage",
     };
 
     private static int HeaderIndex(string markup, string key)
diff --git a/tests/ScadaLink.CentralUI.Tests/Pages/AuditLogPageExportUrlTests.cs b/tests/ScadaLink.CentralUI.Tests/Pages/AuditLogPageExportUrlTests.cs
index 02892a7..400f8ee 100644
--- a/tests/ScadaLink.CentralUI.Tests/Pages/AuditLogPageExportUrlTests.cs
+++ b/tests/ScadaLink.CentralUI.Tests/Pages/AuditLogPageExportUrlTests.cs
@@ -89,6 +89,20 @@ public class AuditLogPageExportUrlTests
         Assert.Equal(exec.ToString(), query["executionId"]);
     }
 
+    [Fact]
+    public void BuildExportUrl_ParentExecutionIdSet_EmitsParentExecutionIdParam()
+    {
+        var parent = Guid.Parse("34343434-5656-7878-9090-121212121212");
+        var filter = new AuditLogQueryFilter(ParentExecutionId: parent);
+
+        var url = AuditLogPage.BuildExportUrl(filter);
+
+        Assert.StartsWith("/api/centralui/audit/export?", url);
+        var query = QueryHelpers.ParseQuery(new Uri("http://x" + url).Query);
+        Assert.Single(query);
+        Assert.Equal(parent.ToString(), query["parentExecutionId"]);
+    }
+
     [Fact]
     public void BuildExportUrl_MultiValueDimensions_EmitRepeatedParams()
     {
diff --git a/tests/ScadaLink.CentralUI.Tests/Pages/AuditLogPageScaffoldTests.cs b/tests/ScadaLink.CentralUI.Tests/Pages/AuditLogPageScaffoldTests.cs
index 55062dd..30acd90 100644
--- a/tests/ScadaLink.CentralUI.Tests/Pages/AuditLogPageScaffoldTests.cs
+++ b/tests/ScadaLink.CentralUI.Tests/Pages/AuditLogPageScaffoldTests.cs
@@ -214,6 +214,45 @@ public class AuditLogPageScaffoldTests : BunitContext
             Arg.Any<CancellationToken>());
     }
 
+    [Fact]
+    public void NavigateWithParentExecutionIdParam_AppliesFilter_AndAutoLoads()
+    {
+        // The "View parent execution" drill-in (and operator-crafted URLs) land on
+        // /audit/log?parentExecutionId={id}. The page parses the Guid, builds an
+        // AuditLogQueryFilter with ParentExecutionId set, and auto-loads the grid.
+        var parentExecutionId = Guid.Parse("aaaaaaaa-1111-2222-3333-bbbbbbbbbbbb");
+        _queryService = Substitute.For<IAuditLogQueryService>();
+        _queryService.QueryAsync(Arg.Any<AuditLogQueryFilter>(), Arg.Any<AuditLogPaging?>(), Arg.Any<CancellationToken>())
+            .Returns(Task.FromResult<IReadOnlyList<AuditEvent>>(new List<AuditEvent>()));
+
+        var cut = RenderAuditLogPageWithQuery($"parentExecutionId={parentExecutionId}", "Admin");
+
+        cut.WaitForAssertion(() =>
+        {
+            _queryService.Received().QueryAsync(
+                Arg.Is<AuditLogQueryFilter>(f => f.ParentExecutionId == parentExecutionId),
+                Arg.Any<AuditLogPaging?>(),
+                Arg.Any<CancellationToken>());
+        });
+    }
+
+    [Fact]
+    public void NavigateWithUnparseableParentExecutionIdParam_IsSilentlyDropped_NoAutoLoad()
+    {
+        _queryService = Substitute.For<IAuditLogQueryService>();
+
+        var cut = RenderAuditLogPageWithQuery("parentExecutionId=not-a-guid", "Admin");
+
+        // An unparseable parentExecutionId leaves ParentExecutionId null. With no
+        // other filter params present the page renders but does NOT call the query
+        // service.
+        cut.WaitForAssertion(() => Assert.Contains("Audit Log", cut.Markup));
+        _queryService.DidNotReceive().QueryAsync(
+            Arg.Any<AuditLogQueryFilter>(),
+            Arg.Any<AuditLogPaging?>(),
+            Arg.Any<CancellationToken>());
+    }
+
     [Fact]
     public void NavigateWithTargetParam_AppliesTargetFilter()
     {