Figure 65 – Client connection process
FindServers returns a list of DiscoverUrls but only for the GDS itself.
The GDS provides the Method QueryApplications which also returns DiscoverUrls for the servers
GetEndpoints returns a list of Server Endpoints

Clarification for "If Address contains a GDS Address, the GDS is queried to find the Server."
How does this work?
How does the CM know if the Address is for a GDS and not for a Server?
If the ServerUri is configured (9.2.2 ServerAddressType definition), this can be used as detection but the ServerUri can be null.
If the Address contains a GDS address, the ServerUri must be provided for discovery and detection.
There is also no reference to this chapter that highlights that the address could be the address of a GDS.

Clarification for "If SecurityPolicyUri contains “BestAvailable”"
Is “BestAvailable” a valid string for SecurityPolicy in the Server definition structures and variables?
If yes, all of the descriptions should either reference this chapter or should list the string „BestAvailable“ as valid value.
It would be better to use the definition from Part 14 instead (and add this to the places where SecurityPolicyUri is defined in Variables and Structures)
Part 14 (6.2.5.4 SecurityKeyServices):
SecurityPolicyUri
If the URI is null or empty, the pull access shall use the best available security policy that is also supported by the pull Client.