The documentation gives the following strategy to handle k-anonymity:
(1)

Since a single interest group can carry multiple possible ads that it might show, the group will have an opportunity to re-bid another one of its ads to act as a "fallback ad" any time its most-preferred choice is below threshold. This means that a small, specialized interest group that is still below the updateUrl threshold could still choose to participate in auctions, bidding with a more-generic ad until the group becomes large enough.

(2)

If generateBid() picks an ad whose rendering URL is not yet above the browser-enforced microtargeting prevention threshold, then the function will be called a second time, this time with a modified interestGroup argument that includes only the subset of the group's ads that are over threshold. (The under-threshold ad will, however, be counted towards the microtargeting thresholding for future auctions for this and other users.)

Let's say I implement the logic explained in (1). I always choose the most specific url first if it is present in the ads field, if none is present I choose the less specific one.

If as described in (2) the 2nd time we call computeBid all urls under the threshold are removed we can never actually display the less specific one, as both url would have been removed.

One strategy could be to always start with the more generic url first until it passes the k-anon threshold. But in this case I need to track this by user, something that only the k-anon server could do.
What would happen if I want to handle more than 2 urls, from more generic to more specific. As I have only 2 possible tries for computeBid I would need to choose two out of many.

Ideally we would like have one of the following behaviors:

1. generateBid() is called again with the original renderUrl removed from the interest group. It is called repeatedly until either generateBid() returns a renderUrl that passes the k-anon threshold or it returns no renderUrl. All renderUrls that were returned in this chain of calls get their k-anon count incremented.
2. generateBid() returns an ordered list of renderUrls and the worklet chooses the first that passes k-anon while incrementing the counts of all other renderUrls that got rejected.