Thanks Tim. You'll see that for now I've run with (1), but the status of "ValidateOnSave" is recorded in the database. This seems to work well in practice. A question author can use "Save and continue editing" repeatedly until the question is in its final state. Then they can turn on validation, save the question, and validation is on thereafter. The worst thing that can happen is that an author forgets to turn on validation and finishes with an invalid question or answer, for which they've only themselves to blame. With validation on by default, authors could lose entire questions that they'd been working on, which was much more annoying and was perceived as my fault. I'll think about changing the default when the current system has bedded in.
I do like your alternate suggestion, though. I'll look into that.
Richard