I think I found two things missed from the specification.
The first is whether engine and/or controller is allowed to use not one, but several spaces (tabs) to separate syntatical entities in commands/ responses. I would say yes, if only because GNU Go parses them fine (mainly with sscanf()). Another, stronger reason is the same why tabs are allowed at all: it might be handy in GTP scripts.
Also, I think there should be some lines about how to handle erroneous responses on the controller side. I'd propose that specification recommends controllers to _not_ try to parse responses that fail to confirm specification. Stricter protocols are way easier to implement properly and we all know what happened to HTML in which erroneous and custom not standardized tags are common.
Paul