For SA cell search procedure as below
In my opinion…
1 Acquire SSB freq on GSCN
4 PBCH and MIB
5 SIB1 then UE gets overall structure…absolute position of ssb wrt BW.
First 8)…then 7) isn’t it?
First 7 only then 8.
Other points fine.
How registration can happen without RRC connection?
It’s only registration request sent by UE in uplink then rrc setup after award registration accept there.
You can just think like attach request scenario.
Yes. But registration request/attach request are NAS messages. They are transffered in uplink once rrc connection is established. But you are right on one part that reason for rrc request is registration attempt. So UE logs you may find registration request first then rach procedure for rrc establishment. But actual uplink transmition of registration happens after rrc established.
By the way think for opening this topic. It is favourite question in interviews 
Ha ha 
I got your point even it’s seem true for LTE where you can seen in logs attach request (NAS message ) after RRC connection setup complete then eNB contact MME by initial UE message.
But for 5G I find registration request come before RRC setup request only.
By 5G I mean SA call.
Without RRC connection UE cannot transmit anything in uplink (except RACH).
Ok nas message carry by rrc setup complete. Got it
Over srb1.
Also 11 Registration complete ia carried by rrc reconfiguration
Check sample call flow above. Very well explained.
To capture all point I given what seen in UE logs.
Embedded message over RRC not seen in flow, but theoretically it’s true.