diff --git a/README.md b/README.md
index c009b48..39d286e 100644
--- a/README.md
+++ b/README.md
@@ -106,28 +106,57 @@ leave its login and every other path alone.
 }
 ```
 
-| Setting | Required? | What to put |
-|---------|-----------|------------|
-| `workflow` | Yes | `insurance` if no patient files, `insurance+patient` if both |
-| `insurance_file_type` | No (defaults to `pdf`) | Set to `tif` for an entity whose imaging system exports the daily files as TIFs instead of PDFs (CAMBS, RMI, CONSENSIO, INLAND). Goes at the top level, next to `workflow` — NOT inside `ftps` |
-| `ftps.host` | Yes | Server address. A plain name (`ftp.example.com`) uses FTP/FTPS per the `tls` setting. You can also paste a full URL — `sftp://server.com` sends these files over **SFTP** instead (some partners use SFTP for everything), and `ftps://server.com` forces FTPS |
-| `ftps.port` | No (defaults to 21) | FTP port, only if not 21 |
-| `ftps.tls` | Yes | `true` for FTPS (secure), `false` for plain FTP |
-| `ftps.username` | Yes | FTP username (shared across all practices) |
-| `ftps.password` | Yes | FTP password |
-| `ftps.tiff_path` | Yes | Remote folder for insurance files — keep `{practice}` in it. (The older name `insurance_path` still works too) |
-| `ftps.pdf_path` | Yes | Remote folder for PT STMT files — keep `{practice}` in it |
-| `sftp.host` | Only if `insurance+patient` | SFTP server address |
-| `sftp.port` | No (defaults to 22) | SFTP port, only if not 22 |
-| `sftp.username` | Only if `insurance+patient` | SFTP username |
-| `sftp.password` | Only if `insurance+patient` | SFTP password |
-| `sftp.patient_path` | Only if `insurance+patient` | Remote folder for patient files — keep `{practice}` in it |
-
 4. Create the `Export1\` folder and a subfolder for each practice inside the entity folder
 
-`{practice}` in any path gets automatically replaced with that practice's
-folder name — so one `entity.json` can serve every practice as long as they
-all follow the same folder-naming pattern on the server.
+---
+
+## Every setting, explained
+
+All of these can appear in `entity.json` (entity-wide default) — and everything
+except `workflow` and `insurance_file_type` can also appear in a
+`practice.json` to override or add a value for just that practice.
+
+### Top level (entity.json only)
+
+| Setting | Values | What it does |
+|---------|--------|--------------|
+| `workflow` | `"insurance"` or `"insurance+patient"` | `insurance` = only the daily date-folder upload. `insurance+patient` = also look for `Patient\Export\PT STMT_<date>\` folders and send their `.txt`/`.tif` files via SFTP |
+| `insurance_file_type` | `"pdf"` (default if null) or `"tif"` | Which file extension to pick up from the daily date folder. TIF entities: CAMBS, RMI, CONSENSIO, INLAND. The PT STMT split works either way (it goes by file *name*, not type) |
+
+### `ftps` section — the daily date-folder upload
+
+| Setting | Values | What it does |
+|---------|--------|--------------|
+| `host` | server name or URL | Where the daily files go. Three forms: plain name (`ftp.example.com`) = FTP or FTPS depending on `tls`; `sftp://server.com` = send over **SFTP** instead (some partners receive everything by SFTP — Pollux is one); `ftps://server.com` = force secure FTP regardless of `tls` |
+| `port` | number, no quotes | Only needed if nonstandard. Null = 21 for FTP/FTPS, 22 for `sftp://` hosts |
+| `tls` | `true` / `false`, no quotes | `true` = secure FTPS, `false`/null = plain FTP. Ignored when `host` starts with `sftp://` (SFTP is always encrypted) |
+| `username` | text | Login for this server |
+| `password` | text | Password for this server |
+| `tiff_path` | remote folder path | Where the regular daily files (insurance TIFs/PDFs) land on the server, e.g. `"/home/clients/CAMBS/{practice}"`. The older name `insurance_path` still works |
+| `pdf_path` | remote folder path | Where PT STMT-named files from the date folder land. Null = this entity has no PT STMTs; if one shows up anyway it's left in place with a notice |
+
+### `sftp` section — the patient-files upload (only used when `workflow` is `insurance+patient`)
+
+| Setting | Values | What it does |
+|---------|--------|--------------|
+| `host` | server name or URL | Patient-files SFTP server (a `sftp://` prefix is fine and stripped automatically) |
+| `port` | number, no quotes | Null = 22 |
+| `username` | text | Login |
+| `password` | text | Password |
+| `patient_path` | remote folder path | Where the `.txt`/`.tif` patient files land, e.g. `"/upload/{practice}/Patient"` |
+
+### Special values that work inside any path
+
+| Token | Becomes |
+|-------|---------|
+| `{practice}` | The practice's local folder name (e.g. `AJMATS`, `CIIR`) — lets one path line serve every practice under the entity |
+
+### Special values that work anywhere
+
+| Value | Meaning |
+|-------|---------|
+| `null` (no quotes) | "We don't use this — ignore it." Files that would need the setting are left in place with a yellow notice, never uploaded, never archived, never counted as failures |
+| any key starting with `_` (like `"_comment"`) | Ignored by the tool — use it for notes to yourself inside the file |
 
 **Missing keys fix themselves:** on every run, the tool checks `entity.json`
 for any keys it knows about that aren't in the file, adds them with a value