"Watch the cleanup side of retention" applies one level up too. On Azure the managed disks that back PVCs have a diskState worth reading before trusting a count: Unattached is the real orphan; Reserved means the disk belongs to a stopped-deallocated VM and comes back on Start; ActiveSAS means someone ran az disk grant-access and is exporting the VHD. The portal-style check "managedBy is null" lists the last two as free to delete; az disk list --query "[?diskState=='Unattached'].[name,diskSizeGb,lastOwnershipUpdateTime]" -o table does not. Same pattern as your snapshots: the object that "works" for days is the one whose delete path nobody exercised, so the inventory is the test.