Makes me wonder to. Is your transaction level 'correctly' configured (don't ask me what correctly is, I'm not a DB guy)
I was suspecting a transaction rollback also, but it turns out that one clever user has wondered onto the page where you can manually move between tasks in a process using the native jbpm-console. Doing that totally messes up things as it leaves the original task open.
We used to link to the native console to show the current process image and the current active task. It turns out there is no way to clamp down permissions sufficiently using the properties file provided.
The solution was to eliminate all access to the native console except for a few admins who understand how to use it. We just serve up the static process image retrieved from the process definition file through a little servlet and the user has to locate the task name on it. The current task name is provided in a small pop up screen.
This incident gave me serious grief and I never seen it in the development environment. We are using JBPM in a production pilot at this point.
Which once again proves that no matter how you design applications, end-users will always find something to break ;-)