Mmm … my understanding is that a sender can prove a payment was delivered by supplying the pre-image. That said, a relay would have to prove that the pre-image and payment_hash was indeed relevant for that tip. That may be resolved with HODL invoices.