SelectBooleanCheckbox rendered state does not match the backing bean

I'm using JSF2.0 and am building up a wizard. I have encountered a problem with SelectBooleanCheckboxes. Here is the workflow:

Load page with checkboxes (values are bound to a SortedMap in the backing bean).
Tick them, and click next. This increments a cursor, which the page uses to determine which PanelGroup the load.
The (correct) values are persisted to the bean.
Click back (cursor is decremented) and page renders the editable checkboxes. The first checkbox is not ticked (even though the bound variable holds a value of true for that box).

This cursor-based approach (which contains all of the wizard screens) doesn't seem to work. However, if i slightly modify this so that the prev/next buttons bring up different xhtml pages, this issue disappears.

Unfortunately I cant do this. We are going to plug this wizard into a modal dialog, so visiting a new page on prev/next will not work

I've written up a smallish example of this (rather than asking you to wade through the entire wizard).

Here is the Java class:

@ConversationScoped
@Named("hashBool")
public class HashBoolTest2 implements Serializable {   

    private static final long serialVersionUID = 1962031429874426411L;

    @Inject private Conversation conversation;

    private List<RestrictionItem> list;
    private SortedMap<String, Boolean> values;

    private int cursor;

    public HashBoolTest2( ) {
        List<String> none = new ArrayList<String>();
        none.add("");

        this.setList( new ArrayList< RestrictionItem >( ) );
        this.getList().add( new RestrictionItem( "a", "a", none ) );
        ...
        this.getList().add( new RestrictionItem( "e", "e", none ) );

        this.setValues( new TreeMap< String, Boolean >() );

        this.setCursor( 0 );
    }

    @PostConstruct
    public void andThis() {
        this.conversation.begin( );
    }

    // getters and setters for instance variables

    @Override
    public String toString() {
        return "Values : " + this.values.toString( ) + " List: " + this.list.toString( );
    }

    public void kill() {
        this.conversation.end( );
    }

    public void doNext(ActionEvent e) {
        this.cursor++;
    }

    public void doPrev(ActionEvent e) {
        this.cursor--;
    }
}

Here is the XHTML fragment:

<?xml version="1.0" encoding="ISO-8859-1" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
  xmlns:ui="http://java.sun.com/jsf/facelets"
  xmlns:h="http://java.sun.com/jsf/html"
  xmlns:f="http://java.sun.com/jsf/core"
  xmlns:c="http://java.sun.com/jsp/jstl/core">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />
<title>IGNORED</title>
</head>
<body>
  <ui:composition>
    <h:panelGroup id="container">
      <h:form>
        <!-- edit state -->
        <h:panelGroup id="edit" rendered="#{hashBool.cursor eq 0}">
            <code>
              <h:outputText value="#{hashBool.toString()}" escape="false"/>
            </code>

            <ul>
              <ui:repeat value="#{hashBool.list}" var="elem">
                <li>
                  <h:selectBooleanCheckbox id="elem" value="#{hashBool.values[elem.id]}" title="#{elem.displayName}" />
                  <h:outputLabel for="elem" value="#{elem.displayName}"/>
                </li>
              </ui:repeat>
            </ul>
        </h:panelGroup>

        <!-- view state -->
        <h:panelGroup id="view" rendered="#{hashBool.cursor eq 1}">
          <code>
            <h:outputText value="#{hashBool.toString()}" escape="false"/>
          </code>
        </h:panelGroup>

        <br/>

        <!-- buttons -->
        <h:panelGroup id="buttons">
          <f:ajax render=":container">
            <h:commandButton value="Prev" actionListener="#{hashBool.doPrev}"/>
            <h:commandButton value="Next" actionListener="#{hashBool.doNext}"/>
          </f:ajax>
          <h:commandButton value="Kill" actionListener="#{hashBool.kill()}"/>
        </h:panelGroup>

      </h:form>
    </h:panelGroup>
  </ui:composition>
</body>
</html>

Any suggestions are welcome! (And sorry if this is a double post, i havnt been able to uncover anything similar while searching here)

Solution

Mainly to ensure that the Wisdom of the Ancients remains properly documented (http://xkcd.com/979/): Turns out this is a bug within JSF 2.0.2 (which comes bundled with Liferay 6.0 GA 4). See here for more info: http://java.net/jira/browse/JAVASERVERFACES-1561