Can I ask then, from the point of view of, say, my local coffee shop taking bitcoin for takeaway coffees.....is it generally safe for them to take an unconfirmed transaction?
If it were my coffee shop I would accept standard unconfirmed transactions with no detected double-spends after a 30 second monitoring period.
Why 30 seconds? How long after you scan the QR code or whatever would you see a problem? Would 10 seconds be enough? Or should it be 2 minutes? I am not selling coffee, I am just thinking from the point of view of a consumer standing in a coffee queue, or at a petrol pump or at a bookstore counter....30 seconds is a damn long time if they have a queue.
I guess somebody would have to do some kind of Monte Carlo simulation with double spends from different points of the Bitcoin network. Then you might be able to say something like "with the current network propagation delay a double spend made 10 seconds after the initial legit transaction has a 0.5% (or whatever %) chance to succeed". They you can adjust your business model to accommodate your risk.