As discussed in #anaconda this morning, it appears that anaconda (well, dracut, really, I think) automatically checks for an images/updates.img in /run/install/repo - which is where it mounts whatever is being used as the 'inst.stage2' source - but not in /run/install/source - which is where it mounts whatever was passed as 'inst.repo'.
bcl doesn't think this is really a bug, but at least some of our test cases and documentation rather give the impression that this should work for 'inst.repo' sources, e.g. https://fedoraproject.org/wiki/Anaconda/Updates reads "If you're doing a CD, hard drive, HTTP, or FTP install you can also put the updates.img in your tree to be picked up by all installs automatically. Put the file in the images/ directory. It must have exactly the name updates.img, even if you received it with a different name.", which is at least ambiguous. This behaviour probably looks a little different post-noloader than it did pre-noloader.
It seems like it'd be an improvement to use /run/install/source/images/updates.img if it's present and there is no /run/install/repo/images/updates.img , assuming the order of mounts makes it possible.
Just going through anaconda bugs; AFAICS this is still valid, though I didn't actually test (too much faffing around). I can't see any changes to the dracut bits since this was filed which would've fixed it.