This tweet seems to imply it’s logs, json, plist and SQLite DB.
Biome — /private/var/mobile/Library/Biome/streams/.../Notification/segments/ — the raw title/body logs
2. BulletinBoard + UserNotificationsCore — /var/mobile/Library/{BulletinBoard,UserNotificationsCore}/.{json,plist} — delivered + dismissed state
3. CoreDuet — /var/mobile/Library/CoreDuet/coreduetdClassD.db — SQLite that re-ingests Biome events
I don’t think they are correct