The caller receives null, so the tombstone event is sent without merge, while the native event file remains in the outbox for OutboxSender to send — resulting in a duplicate crash report.

That is exactly the intended fallback behavior: if we cannot fully deserialize the event, there is nothing to merge, so we send only the tombstone. It is possible that we were able to decode the timestamp, but the remaining event is somehow corrupted. So, this is a valid failure mode, and the current behavior is exactly what I would expect.

If the OutboxSender successfully transmits the event anyway, great. But more likely it will also fail (since it uses exactly the method of deserialization). So the worry about duplicate events is also overblown: it either transmits the event and we send both events (in the curiously rare situation where the same deserialization fails once but works in the other case), or it fails (most likely).