The second point refers to "Pakistani state involvement". You are harping on the quality of evidence, I'm merely pointing out that the GoI is absolutely convinced that elements of the ISI, authorised or not, were part of the operation. .
There are apparently certain circles that narrate retired ISI operatives still being assets. People who were handlers of past to ensure that there was no link back to the ISI directly. Now what if some of these handlers after being let go decided to plan out an operation on their own? Because in all fairness, I still dont see any tactical, strategic or even pro-Kashmir thing coming out of the 26/11 plan. I mean think about it, if there really was to be an attack.. why Mumbai? what possible gain , what possible effect could the Pakistani state establish other than fear mongering and that too when it is embroiled on another front already? The establishment does do dumb things but this sort of move requires downright daftness to be accepted as prosperous to Pakistan's cause. However, there are always those(on both sides) whose bread and butter depends on the hostility between the two nations and for those assets it might be useful to keep the pot boiling.
Quite simply the 2008 attacks do not seem to be from a current instrument of state. Ex-employees maybe, but then they were on their own. There are always theories of false flag to boost the excuse for beefing up the defense of India, but those are extreme hyperbole that go into Zaid Hamid territory.