RPC method listtransactions behavior in double spend attack scenario
I am developing code to process bitcoin payments for my upcoming business venture. I am using the RPC method listtransactions - I've found some useful information about that method's behavior in a few other posts ; my thanks to those who provided that info. What I haven't found is how this method will behave in a double spend attack scenario. Suppose a transaction is created and it gets to 2 confirmations (the more complex attacks) before it is detected. Once it is detected, I need to know whether:
1) listtransactions continues to return the transaction, OR
2) listtransactions stops returning the transaction
And if the answer is #1, will the confirmations count returned by the method decrease? Or just never increase? Or is the transaction marked some other way to indicate what has happened?