The evil attackers don't necessarily care whether in some sense your system "doesn't commit" one of the duplicates. Especially if they can manipulate it to choose whether the "not committed" one is the one they created or one emitted by a real user.

I know it was intended flippantly but the attackers do not get the HTTP response code - they're obliged to conduct this attack blind, if they can decrypt the messages then your problem isn't a replay attack but some previously unimagined TLS flaw.

So, suppose your system sees three versions of a transaction to transfer $1M to Dr Evil. You're not worried because two of them "won't commit" but do your end users understand that? (hint: they do not). Let's call these versions A, B and C. The real user's web browser believes transaction A succeeded, and is unaware of B and C.

Dr Evil complains that the money never arrived, and our user checks, alas they see that eventually transaction A failed (it was judged a duplicate of B, and so was C) and this explains the problem. They initiate a new transfer, let's call that Z. This succeeds and Dr Evil is satisfied.

Unfortunately now Dr Evil has $2M instead of $1M.