Find suggested matches for the session (buyer→sellers or seller→buyers). Canonical fit score = deterministic x semantic, threshold 50. Communication-eligibility (the warm gate): a match is returned only when at least one of the two counterparties is warm — it appears in the platform's e-mail-thread index — never cold x cold, which is why this list is deliberately short (default limit 10). GET /api/deal-flow/{session_id} covers the WHOLE scored universe instead. Security gates: counterparty names are redacted and revenue/growth/EBITDA fit is shown only as coarse bands (strong/moderate/weak/poor) until an NDA is recorded — granular metrics and real names unlock only after POST /api/nda/sign. SIDE EFFECT — suggestion logging: each counterparty actually returned is recorded once as a matched event referencing the session entity, which is what feeds that counterparty's Interest Signals counts (GET /api/interest-signals/{session_id}). Logging is idempotent per pair per UTC day (a refresh, a re-render or a second tab add nothing) and capped at 50 pairs per call. NO pairings are created by this endpoint: the pipeline only gains rows when a client explicitly POSTs /api/pairings/create, so a passive grid view can never inflate the pipeline.