diff --git a/maintenance/delete-orphan-services.sh b/maintenance/delete-orphan-services.sh
index 452a59f..3993ca3 100755
--- a/maintenance/delete-orphan-services.sh
+++ b/maintenance/delete-orphan-services.sh
@@ -1,37 +1,35 @@
 #!/usr/bin/env bash
 set -euo pipefail
- 
+
 APPFACTORY_ROOT="/opt/appfactory"
 DB_FILE="$APPFACTORY_ROOT/data/appfactory/appfactory.db"
 WORKSPACE_DIR="$APPFACTORY_ROOT/workspace"
 DELETE_SCRIPT="$WORKSPACE_DIR/appfactory-tools/scripts/delete-app.sh"
 
-# Výchozí režim pouze vypisuje kandidáty.
 DRY_RUN="${DRY_RUN:-1}"
-
-# Čerstvé adresáře nemažeme. Selhávající provisioning může ještě dobíhat.
 MIN_AGE_HOURS="${MIN_AGE_HOURS:-24}"
 MIN_AGE_MINUTES=$((MIN_AGE_HOURS * 60))
 
-CORE_SERVICES=(
-  appfactory-tools
-  appfactory-portal
-  appfactory-worker
-  appfactory-monitor
-  appfactory-webhook
+PROTECTED_WORKSPACES=(
   appfactory-infrastructure
+  appfactory-monitor
+  appfactory-portal
+  appfactory-tools
+  appfactory-webhook
+  appfactory-worker
+  python-fastapi-template
 )
 
 log() {
   printf '%s %s\n' "$(date '+%Y-%m-%d %H:%M:%S')" "$*"
 }
 
-is_core_service() {
+is_protected() {
   local candidate="$1"
-  local core
+  local protected
 
-  for core in "${CORE_SERVICES[@]}"; do
-    if [ "$candidate" = "$core" ]; then
+  for protected in "${PROTECTED_WORKSPACES[@]}"; do
+    if [ "$candidate" = "$protected" ]; then
       return 0
     fi
   done
@@ -39,6 +37,14 @@ is_core_service() {
   return 1
 }
 
+is_registered() {
+  local candidate="$1"
+
+  sqlite3 "$DB_FILE" \
+    "SELECT 1 FROM apps WHERE id = '$candidate' LIMIT 1;" |
+    grep -qx 1
+}
+
 if [ ! -f "$DB_FILE" ]; then
   log "ERROR: Databáze neexistuje: $DB_FILE"
   exit 1
@@ -49,65 +55,40 @@ if [ ! -x "$DELETE_SCRIPT" ]; then
   exit 1
 fi
 
-# Bez důvěryhodného zdroje pravdy nic nemažeme.
-if ! sqlite3 "$DB_FILE" \
-  "SELECT 1 FROM sqlite_master WHERE type='table' AND name='apps';" |
-  grep -qx 1; then
-  log "ERROR: Tabulka apps nebyla nalezena. Automatické mazání zastaveno."
-  exit 1
-fi
-
-mapfile -t REGISTERED_APPS < <(
-  sqlite3 "$DB_FILE" \
-    "SELECT id FROM apps WHERE id IS NOT NULL AND trim(id) <> '' ORDER BY id;"
-)
-
-is_registered_app() {
-  local candidate="$1"
-  local registered
-
-  for registered in "${REGISTERED_APPS[@]}"; do
-    if [ "$candidate" = "$registered" ]; then
-      return 0
-    fi
-  done
-
-  return 1
-}
-
 found=0
+deleted=0
+failed=0
 
 while IFS= read -r app_dir; do
   app_id="$(basename "$app_dir")"
 
-  if is_core_service "$app_id"; then
+  if is_protected "$app_id"; then
     continue
   fi
 
-  if is_registered_app "$app_id"; then
+  if is_registered "$app_id"; then
     continue
   fi
 
-  # Nedotýkat se čerstvého workspace.
-  if ! find "$app_dir" -maxdepth 0 -mmin "+$MIN_AGE_MINUTES" |
-       grep -q .; then
+  if ! find "$app_dir" -maxdepth 0 -mmin "+$MIN_AGE_MINUTES" | grep -q .; then
+    log "SKIP fresh orphan candidate: $app_id"
     continue
   fi
 
   found=$((found + 1))
-  log "ORPHAN candidate: $app_id"
+  log "ORPHAN: $app_id"
 
   if [ "$DRY_RUN" = "1" ]; then
-    log "DRY-RUN: byl by spuštěn delete-app.sh $app_id"
+    log "DRY-RUN: spustil by se delete-app.sh $app_id"
     continue
   fi
 
-  log "Deleting orphan: $app_id"
-
   if "$DELETE_SCRIPT" "$app_id"; then
-    log "Deleted: $app_id"
+    deleted=$((deleted + 1))
+    log "DELETED: $app_id"
   else
-    log "ERROR: Mazání selhalo: $app_id"
+    failed=$((failed + 1))
+    log "FAILED: $app_id"
   fi
 done < <(
   find "$WORKSPACE_DIR" \
@@ -118,4 +99,8 @@ done < <(
   sort
 )
 
-log "Finished. Orphan candidates: $found; DRY_RUN=$DRY_RUN"
\ No newline at end of file
+log "Finished. Found=$found Deleted=$deleted Failed=$failed DryRun=$DRY_RUN"
+
+if [ "$failed" -gt 0 ]; then
+  exit 1
+fi
\ No newline at end of file