When it comes to State 2, I doubt that the probability is still X, because the public network has been working all along, while the attacker starts after 1 block ahead and he/she may needs some time to collect transactions.
Transactions are continuously collected. There is no delay for collecting transactions. The "selfish miner" can immediately begin the next block as soon as they complete one.