The delivery proof

Every pushed change notice writes an append-only legal_notices row (unless you turn durable_medium.proof off): who was informed, when, on which medium, the exact text sent, its hash, and whether the notice carried its mandatory content.

That is the evidence a durable-medium notice actually went out (CJEU C-375/15) — audit it like any model:

What the row proves, and since when

The row is written by a listener on NotificationSent, so it exists because the mail channel accepted the message — not because the sweep reached the subject in its own loop. Before 0.19.0 it was written at ENQUEUE time, which meant a dead worker or a refusing transport produced a green run and a proof row for a notice nobody received. If your ledger predates 0.19.0, rows from before the upgrade attest that the notice was queued.

It does not attest RECEIPT. NotificationSent means the mailer took the message; there is deliberately no delivered_at, because a column claiming more than the package can observe would be worse than no column.

use Pushery\LegalConsent\Models\LegalNotice;

$proof = LegalNotice::query()->where('document_key', 'terms')->latest('sent_at')->get();
$deficient = LegalNotice::query()->where('mandatory_content_ok', false)->exists(); // should be false

Retention

The proof is append-only and holds personal data, so legal-consent:prune covers it on the same retention rule as the consent ledger: superseded and orphaned rows past the period go, while the newest notice per subject and document is kept — it is what proves the change behind their current standing was lawfully announced.

The prune sweep is off by default. See Retention.