diff --git a/.env.example b/.env.example
index cbce12a..4b76f6f 100644
--- a/.env.example
+++ b/.env.example
@@ -1,60 +1,79 @@
-# Tinker Tickets Environment Configuration
-# Copy this file to .env and fill in your values
-#
-# NOTE: This file is parsed with parse_ini_file(). Any value containing special
-# characters (#, ;, =, quotes, spaces, etc.) MUST be wrapped in double quotes,
-# e.g. DB_PASS="p@ss;word#1". The application now fails loudly (dies with a clear
-# error) if the .env file cannot be parsed, so an unquoted special character will
-# take the whole app down rather than silently using a wrong value.
+; Tinker Tickets Environment Configuration
+; Copy this file to .env and fill in your values
+;
+; NOTE: This file is parsed with PHP's parse_ini_file. Any value containing
+; special characters -- #, ;, =, quotes, spaces, etc. -- MUST be wrapped in
+; double quotes, e.g. DB_PASS="p@ss;word#1". The application now fails loudly
+; -- dies with a clear error -- if the .env file cannot be parsed, so an
+; unquoted special character will take the whole app down rather than
+; silently using a wrong value.
+;
+; Comments in this file use ";" rather than "#": PHP's ini parser treats "#"
+; comments as fragile -- punctuation like parentheses or quotes inside a "#"
+; comment can produce a syntax error even though the line is meant to be
+; inert, silently breaking every value below it. ";" comments don't have this
+; problem, so keep using ";" for any comment added to this file.
 
-# Database Configuration
+; Database Configuration
 DB_HOST=10.10.10.50
 DB_USER=tinkertickets
 DB_PASS=your_password_here
 DB_NAME=ticketing_system
 
-# Matrix Webhook (optional - for notifications via matrix-hookshot)
-# Set to your hookshot generic webhook URL, e.g.:
-#   https://matrix.lotusguild.org/webhook/<uuid>
+; Matrix Webhook (optional - for notifications via matrix-hookshot)
+; Set to your hookshot generic webhook URL, e.g.:
+;   https://matrix.lotusguild.org/webhook/uuid-goes-here
 MATRIX_WEBHOOK_URL=
 
-# Matrix users to @mention on every new ticket (comma-separated Matrix user IDs)
-# e.g. @jared:matrix.lotusguild.org,@alice:matrix.lotusguild.org
+; Matrix users to @mention on every new ticket (comma-separated Matrix user IDs)
+; e.g. @jared:matrix.lotusguild.org,@alice:matrix.lotusguild.org
 MATRIX_NOTIFY_USERS=
 
-# Application Domain (required for Matrix webhook ticket links)
-# Set this to your public domain (e.g., t.lotusguild.org)
+; Matrix homeserver domain (used to build Matrix user IDs from LLDAP usernames)
+MATRIX_DOMAIN=
+
+; Synapse internal URL and admin token (used to resolve usernames -> Matrix IDs
+; for watcher DMs)
+SYNAPSE_ADMIN_URL=
+SYNAPSE_ADMIN_TOKEN=
+
+; Optional: send a Matrix notification on comments and/or assignments (0/1)
+MATRIX_NOTIFY_COMMENTS=0
+MATRIX_NOTIFY_ASSIGNMENTS=0
+
+; Application Domain (required for Matrix webhook ticket links)
+; Set this to your public domain, e.g. t.lotusguild.org
 APP_DOMAIN=
 
-# Allowed Hosts for HTTP_HOST validation (comma-separated)
-# Include all domains that can access this application
+; Allowed Hosts for HTTP_HOST validation (comma-separated)
+; Include all domains that can access this application
 ALLOWED_HOSTS=localhost,127.0.0.1
 
-# Trusted reverse proxy IP(s), comma-separated (e.g. the Authelia/nginx proxy).
-# Set this to the IP address(es) of your reverse proxy. Authelia forward-auth
-# headers (Remote-User / Remote-Groups) and forwarded client IPs are only
-# trusted when REMOTE_ADDR is in this list.
-#
-# Leaving this EMPTY disables reverse-proxy verification entirely: the app then
-# trusts Remote-User / Remote-Groups headers from ANY source. That is unsafe if
-# the PHP backend is reachable directly (bypassing the proxy), because a client
-# can then spoof those headers and log in as an admin. Only leave it empty when
-# network topology guarantees PHP is reachable solely via the trusted proxy.
-#
-# Exact IP match only (no CIDR). Example (single proxy): TRUSTED_PROXIES=10.10.10.27
-# Example (multiple):                                     TRUSTED_PROXIES=10.10.10.27,10.10.10.28
+; Trusted reverse proxy IPs, comma-separated -- e.g. the Authelia/nginx proxy.
+; Set this to the IP address(es) of your reverse proxy. Authelia forward-auth
+; headers (Remote-User / Remote-Groups) and forwarded client IPs are only
+; trusted when REMOTE_ADDR is in this list.
+;
+; Leaving this EMPTY disables reverse-proxy verification entirely: the app then
+; trusts Remote-User / Remote-Groups headers from ANY source. That is unsafe if
+; the PHP backend is reachable directly (bypassing the proxy), because a client
+; can then spoof those headers and log in as an admin. Only leave it empty when
+; network topology guarantees PHP is reachable solely via the trusted proxy.
+;
+; Exact IP match only (no CIDR). Example (single proxy): TRUSTED_PROXIES=10.10.10.27
+; Example (multiple):                                     TRUSTED_PROXIES=10.10.10.27,10.10.10.28
 TRUSTED_PROXIES=
 
-# Timezone (default: America/New_York)
+; Timezone (default: America/New_York)
 TIMEZONE=America/New_York
 
-# LDAP / lldap (for user avatar lookups)
+; LDAP / lldap (for user avatar lookups)
 LDAP_ENABLED=true
 LDAP_HOST=10.10.10.39
 LDAP_PORT=3890
-LDAP_BIND_DN=uid=tinker-tickets,ou=people,dc=example,dc=com
+LDAP_BIND_DN="uid=tinker-tickets,ou=people,dc=example,dc=com"
 LDAP_BIND_PW=
-LDAP_BASE_DN=dc=example,dc=com
-LDAP_USER_BASE=ou=people,dc=example,dc=com
-# How long to cache avatar images locally (seconds, default 3600)
+LDAP_BASE_DN="dc=example,dc=com"
+LDAP_USER_BASE="ou=people,dc=example,dc=com"
+; How long to cache avatar images locally (seconds, default 3600)
 AVATAR_CACHE_TTL=3600