Currently, for testing updates, latest-pkg in the template script is running against dist-<whatever>-updates-candidate. It needs to run against dist-<whatever>-updates, for both testing and final updates. The reasoning is that you want the changes since the last package actually released (either in the GA release or as an official update).
latest-pkg now runs against -updates, regardless of final/testing status.