Correct.... That is the way releasing releases works. You have a reporting issue where you mention in which release it has to be fixed. If an issue is fixed it is in CVS-Head... so you can checkout that.
Besides that, there is a roadmap that shows on all issues that need to be fixed before a release is done. Often it also includes a 'guestimate' for a releasedate.
In this case, 3.2.3 is not released yet, so it is not in binary or even tagged in cvs. 3.2.2 SOA1 is for inclusion in the JBoss SOA release and will not be a separate jBPM release. If it is tagged in CVS I do not know.
Which file(s) contained the fix? I'm having an issue that sounds very similar to this. In our system we have a parent process that has a fork that has transitions to 4 <process-state name="xxxxx" async="true"> nodes that then transition to a join. Periodically we get a StaleObjectException when the sub process completes, signals the parent process so it does the join processing. The transaction is rolled back which includes all the work done in the sub process. The description of the problem and the solution sound like a very good match to the problem I'm seeing. I'd like to apply the fix to our current code base while we wait for 3.2.3 to be released and see if it solves this problem too. If not, it might help me identify the solution to my particular scenario if the root cause isn't the same.
Not sure, best is to checkout the full cvs-head and run that. CVS head versions in jBPM are usually very stable.