Per-session request counter. Client must send the last echoed value (or 0 / omit on first POST); -1 resets bin + counter. Server increments on accept.