This is true for elements and attributes, but not for the values of defined attributes and the text content of defined elements.
Hm, is it? I'd interpret it less strictly. For me <show>online</show> is a non-conformant element.
In any case: closing the connection is certainly the wrong answer, especially since the <show/> element is just an optional information intended mostly for human users. It's also nowhere specified/recommended. Why not just log a warning instead?