https://github.com/filcdn/worker/blob/ee63c60b75244734b66026bafbc686a36917bc29/retriever/lib/store.js#L164

This should use withClientNotSanctioned, not withCDN. Otherwise, if you e.g. have one unsanctioned and one sanctioned client, the sanctioned client might be selected.

Bug confirmed by @bajtos