How this fills up: portal-api writes an audit row for every mutation (add / delete / update connection, set server config, import TOML) and for permission denials. If this list is empty, no operator has touched the config since the store was seeded. The seeded demo connections are not audited because they're loaded before the portal-api starts.