anchor.diff:  To prevent this situation, the primary needs to wait for the master to acknowledge replica shard failures before acknowledging the write to the client. {GIT}14252[#14252]
   
   [float]
  -=== Safe primary relocations (STATUS: UNRELEASED, v5.0.0)
  +=== Safe primary relocations (STATUS: DONE, v5.0.0)
   
   When primary relocation completes, a cluster state is propagated that deactivates the old primary and marks the new primary as active. As
   cluster state changes are not applied synchronously on all nodes, there can be a time interval where the relocation target has processed the
  
positive.code: that no failures are found.
  
  
  == Unreleased
  
  [float]
  === Port Jepsen tests dealing with loss of acknowledged writes to our testing framework (STATUS: UNRELEASED, V5.0.0)
  
  We have increased our test coverage to include scenarios tested by Jepsen that demonstrate loss of acknowledged writes, as described in
  the Elasticsearch related blogs. We make heavy use of randomization to expand on the scenarios that can be tested and to introduce
  
negative.code: stale shard copy.
  
  [float]
  === Make index creation resilient to index closing and full cluster crashes (STATUS: DONE, v5.0.0)
  
  Recovering an index requires a quorum (with an exception for 2) of shard copies to be available to allocate a primary. This means that
  a primary cannot be assigned if the cluster dies before enough shards have been allocated ({GIT}9126[#9126]). The same happens if an index
  