simple validation silently fails on update or save

where's the update method in your controller? maybe (guessing longshot) putting :on => :update_email
will work? or using the update method in the given action etc

Validations are called against models, not controllers.

Clare: You should be about to just leave set up the validation like this:

class User < ActiveRecord::Base
  validates_format_of :email, :with => /^([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})$/i

That should fire on any save command.