msabin - your basically correct with one tweek
The AP establishes a PAPI connection (UDP-8211) with the controller for communication, this is done at step 2 after the controller discovery, the PAPI connection is used to send in the AP name (MAC address on factory default AP) and AP group information, as well as compare the OS. Now in step 4 the OS is transfered , then AP reboots, and goes back through steps 1-4 but no need for OS transfer so through PAPI it gets a fresh copy of it's config. Then the AP reads the config, builds the GRE tunnels to support User Data , then turns on the radios.
so looks like this
The AP gets an IP address (either statically assigned or from DHCP)
2. The AP locates the master (or local) controller through ADP or DNS lookup or static entry
2a Ap establishes PAPI for communicaion sends in NAME and AP Group
3. The AP checks its firmware revision against the controller
4. (A) The AP transfers OS from controller (reboot)
5. (B) AP gets fresh config configuration including (C) determining the IP address if its controller (which may be the same as the controller it got the image from, but might just as well not)
5d - builds GRE tunnels
6. (D) The AP redio is enabled