Don't read more data from the database than needed.
made sure predictions can't be below 0.
For now using symlinks are a no go as lsof lists the symlink target and hence we don't know which apps are actually used.