When entering a short test sequence on my remote this is what my receiver displays (a dot means an exact repetition of the previous packet):

All on:
07 B0 F2 EA 35 90 01 B9 AC F9 ..........................
07 B0 F2 EA 35 90 00 B9 74 E0 ..

Color red:
07 B0 F2 EA 04 90 0F BA 6E 01 
07 B0 F2 EA 04 90 0F BB E7 10 
07 B0 F2 EA 04 90 0F BC 58 64 
07 B0 F2 EA 04 90 0F BD D1 75 
07 B0 F2 EA 04 90 0F BE 4A 47 
07 B0 F2 EA 04 90 0F BF C3 56 
07 B0 F2 EA 04 90 0F C0 B3 DD 
07 B0 F2 EA 04 90 0F C1 3A CC 
07 B0 F2 EA 04 90 0F C2 A1 FE 
07 B0 F2 EA 04 90 0F C3 28 EF 
07 B0 F2 EA 04 90 0F C4 97 9B 
07 B0 F2 EA 04 90 0F C5 1E 8A 
07 B0 F2 EA 04 90 0F C6 85 B8 
07 B0 F2 EA 04 90 0F C7 0C A9 
07 B0 F2 EA 04 90 0F C8 FB 51 
07 B0 F2 EA 04 90 0F C9 72 40 
07 B0 F2 EA 04 90 0F CA E9 72 
07 B0 F2 EA 04 90 0F CB 60 63 
07 B0 F2 EA 04 90 0F CC DF 17 
07 B0 F2 EA 04 90 0F CD 56 06 
07 B0 F2 EA 04 90 0F CE CD 34 
07 B0 F2 EA 04 90 0F CF 44 25 
07 B0 F2 EA 04 90 00 CF 8C A6 ............................

Group 1 on:
07 B0 F2 EA 04 91 03 D0 4E 3E .............................
07 B0 F2 EA 04 91 03 D1 C7 2F .............................

Group 1 white:
07 B0 F2 EA 04 91 13 D2 CD 88 .............................
07 B0 F2 EA 04 91 13 D3 44 99 .............................

Color green:
07 B0 F2 EA 7D 91 0F D4 EC 72 
07 B0 F2 EA 7D 91 0F D5 65 63 
07 B0 F2 EA 7D 91 0F D6 FE 51 
07 B0 F2 EA 7D 91 0F D7 77 40 
07 B0 F2 EA 7D 91 0F D8 80 B8 
07 B0 F2 EA 7D 91 0F D9 09 A9 
07 B0 F2 EA 7D 91 0F DA 92 9B 
07 B0 F2 EA 7D 91 0F DB 1B 8A 
07 B0 F2 EA 7D 91 0F DC A4 FE 
07 B0 F2 EA 7D 91 0F DD 2D EF 
07 B0 F2 EA 7D 91 0F DE B6 DD 
07 B0 F2 EA 7D 91 0F DF 3F CC 
07 B0 F2 EA 7D 91 0F E0 4B 05 
07 B0 F2 EA 7D 91 0F E1 C2 14 
07 B0 F2 EA 7D 91 0F E2 59 26 
07 B0 F2 EA 7D 91 0F E3 D0 37 
07 B0 F2 EA 7D 91 0F E4 6F 43 
07 B0 F2 EA 7D 91 0F E5 E6 52 
07 B0 F2 EA 7D 91 0F E6 7D 60 
07 B0 F2 EA 7D 91 0F E7 F4 71 
07 B0 F2 EA 7D 91 0F E8 03 89 
07 B0 F2 EA 7D 91 0F E9 8A 98 
07 B0 F2 EA 7D 91 00 E9 42 1B ............................

Group 1 off:
07 B0 F2 EA 7D 91 04 EA B9 4E .............................

I already know that the first byte is length, the last two bytes are CRC and the one before that is a packet ID that is incremented for each distinct packet (but kept the same for resends). That leaves 6 bytes in the middle: In my first preliminary assessment they seem to be:

• 3 bytes remote/gateway ID (that turns out to be not entirely accurate, see below)
• 1 byte value of the color slider (I designate it VAL1)
• 1 byte value of the brightness slider (I designate it VAL2)
• 1 byte button status (I designate it CMD)

This is not a proper "command" set. This is just the current state of the remote control, transmitted in the most unimaginative way possible. By looking at the lower nibble of the CMD byte I can map it to the buttons on the remote as follows:

• 00 means that no button is touched, which only happens if you use one of the touch sliders and then let go: The remote streams every intermediate value immediately with no resends, but then adds the customary amount of resends –with different CMD but identical counter!– after you let go.
• The least significant bit of the upper nibble in the CMD byte indicates a long press on the corresponding button: 0x11 is "all: white", 0x12 is "all: night mode", 0x13 is "group 1: white", and so on. This applies even to the disco mode buttons (but doesn't seem to trigger any functionality in the bulb), but obviously not the sliders.

The value of the sliders are as follows:

• VAL1 is color. Goes from 0x00 all the way round to 0xFF. 0x00 is 9 o'clock on the slider (a purple), approx. 0x1B is half past 7 (pure red), 0x80 is 3 o'clock (a cyan), approx 0xBA is 12 o'clock (pure blue).
• VAL2 is brightness: Goes from 0x90 at the leftmost end, down(!) to 0x00 in the middle, to 0xA8 on the rightmost end, in increments of 0x08.

There's one additional peculiarity: The very first byte immediately after the length seems to also encode information. For my remote it is 0xB0 most of the time, except when repeatedly pressing disco mode: Then it increments up to 0xB8 and overflows back to 0xB0. This value is kept when pressing other buttons, but reset on touching the color wheel. The value seems to directly select a disco mode. I was wondering before how that worked: switching disco mode on independent bulbs, then doing an "all on", and pressing disco mode again would select the same disco mode on all bulbs. That wouldn't be possible if the only information the remote transmitted was "next disco mode", because then the bulbs would easily desynchronize with respect to what the current mode was. The modes are:

I'm not entirely sure yet if the 0xB0 is part of the remote/gateway ID (meaning the ID would have 20 bits) or something else entirely (making for an ID of 16 bits).