Why is the in-sync replica (ISR) set important for durability?

The ISR is the set of replicas — leader plus any followers — that are fully caught up with the leader's log at a given moment. It matters because it's the actual pool of candidates eligible to become the new leader if the current one fails, and it's what acks=all and min.insync.replicas are checking against, not the full, nominal replica count.

A topic can have a replication factor of 3 on paper, but if two of those three replicas have fallen behind (say, due to a slow disk or network issue) and dropped out of the ISR, the effective durability at that moment is whatever a single in-sync replica provides — the nominal replication factor overstates the real protection until those followers catch back up and rejoin the ISR. This is exactly why min.insync.replicas exists: it lets a broker refuse writes outright rather than silently accepting them with weaker-than-intended durability during a period when the ISR has shrunk, making the durability gap visible as write failures instead of an invisible risk.