Just found this thread and I've been working through a similar line of thought. What I found interesting is the remote item for song time (H:M:S.ms) has the exact same range as the bars/beats/ticks item, that is talked about here.
The other thing I notist was changing the tempo seems to affect both values in how they relate to bars/beats/ticks and H:M:S.ms. I suspect the range value is arbitary in that the max song length may relate to tempo or the remote range is limited and may not go up to the max song length.
This seems a little like the ssl track limit of 64 with a max start from track of 128 via remote. However, it is possible to have 256 or more tracks. Again I haven't tested this extensively and assume the track limit may relate to the system running reason.
I'm using web tech: WebMidi.js, jQuery, speech API, bootstrap with loopmidi, Remote LUA codecs and have a speaking ReDrum controller here:
https://www.nostex.co.uk/ReDrum/
One thing I had to work round was the 8bit value being sent in 7bit sysex message data, so needed to convert in the LUA codec. I think I managed this and had the output set as text sysex value and just converted to decimal in js.
Although my aim is a little different as I am looking to improve accessibility for blind reason users, cue points or song markers is one feature I was looking to do as well.
If you'd like to share each others work or collabrate on a project, please feel free to get in touch.
You can view source of the above web page, to see the js code I've used, download the lua codec etc.
best, john