coldstorage – How does a HD wallet work in practice?

However, if grandchild key pair 1 contains 1 BTC, and grandchild key pair 2 contains 2 BTC, could I send the 3 BTC total as a single transaction?

Yes, but not in the way you describe it.

Bitcoin, at the protocol level, does not “belong” to a key. That is, there is no balance per address or per key as a concept.

Instead, think of them as coins. Every time you get paid, you receive a separate new “coin”. Each coin has a little program (the locking script) that determines who is allowed to spend it. In practice, your coins are ones with a locking script that requires a signature with a key you have.

The protocol permits creating transactions that spend multiple coins at once. It does not matter whether those coins all have the same address, or different addresses derived from the same master key, or even if they have completely unrelated addresses entirely. They’re just multiple coins, and each coin individually requires a signature.

in fact, nothing prevents multiple people from constructing a single transaction that spends multiple coins owned by different people in the same transaction. This is called a CoinJoin transaction.

If so, would this appear on-chain to leave from the child key pair address from which both are derived?

All HD wallets do is change the way an individual wallet derive their keys. Other nodes or parties on the network do not know or care the keys are constructed in a related way. As long as they do not know the master public key, your keys are indistinguishable from random keys. The only thing visible on chain is that the transaction spent coins that were previously sent to distinct addresses, but this is the case for almost all transactions on the network.

If the master private key was in cold storage, but one of the child private keys was not, could the wallet be defined as a cold wallet?

This is not possible with non-hardened keys. Given a child private key and the master public key, you can compute the master private key, and from that, all other child private keys.

Thus, you scenario is equivalent to the non-cold system having access to all private keys, and the whole setup is very much not cold.

With hardened keys, knowing the child private key does not reveal the master private key, but you lose the advantage of being able to compute child public keys without access to the master private key.

in either case, I would not call this a cold setup. I would reserve that term for setups where no coins are ever on an online system.