Water allocation in capacity-constrained canal trees with conveyance losses requires local limits and guaranteed service to be considered simultaneously. We develop a deterministic three-stage lexicographic model for a rooted tree with fixed routes. Stage 1 maximizes the minimum service ratio, Stage 2 maximizes weighted seasonal satisfaction subject to that guarantee, and Stage 3 minimizes temporal service-ratio variation while preserving the preceding optima. The nonnegative packing structure yields the Stage-1 optimum in closed form from capacity-to-full-load ratios; the loss-aware path operator is equivalent to node balance and determines unique gross flows. In five exact benchmarks, the maximum discrepancy between the closed-form and linear-programming solutions was 1.11×10⁻¹⁶, with zero operator–balance residual. Scaling tests with up to 500 users and 1022 edges yielded a maximum discrepancy of 2.22×10⁻¹⁶. In the three-period test, the temporal variation ranged from 0.40 to 1.05 over the Stage-2 optimal face, and Stage 3 attained 0.40. The price of fairness was 3.29% in the controlled Gone Abat Jap scenario. The results provide a model-specific analytical characterization and a reproducible computational framework for loss-aware allocation on fixed-route irrigation trees.

When an irrigation canal is put on restriction, what is fair depends on the water each user receives, not on what was allocated: transport delay and the stabilising low-pass filter re-shape every order on the way to the offtake. We pose the problem as lexicographic max-min optimisation of the fraction of each user’s order delivered inside an agreed window, after the filter. The orders are the decision variables, re-shaped before the filter, leaving the controller and filter untouched. The delivered fractions are affine in the orders, so this is a finite sequence of linear programmes. Relaxing the control law alone yields a certified upper bound; an infeasibility certificate reports whose order cannot be met and what must give. On a published eight-pool test canal the criterion raises the worst-off delivered fraction by 0.074 to 0.180 over leaving orders unchanged; the bound is attained at nine of eleven operable supply levels, where the control layer loses nothing. A 50% larger volume budget leaves the lexicographic answer unchanged. The filter’s order decides whether a feasible schedule exists, its cut-off only what is delivered; neither moves the comparison between criteria much. On this canal filter design precedes the choice of fairness criterion.

Water allocation in lossy canal trees must respect local capacities and a service guarantee. We develop a deterministic three-stage lexicographic model for a rooted, fixed-route tree: Stage 1 maximizes the minimum service ratio, Stage 2 maximizes weighted seasonal satisfaction subject to that guarantee, and Stage 3 minimizes temporal service-ratio variation while preserving both optima. The nonnegative packing structure yields the Stage-1 optimum in closed form from capacity-to-full-load ratios, and the loss-aware path operator equals node balance. Across 400 randomized instances, 140 with capacities not tied to their own loads, and 60 more with load-independent scales, the closed form agreed with linear programming (LP) to 2.2 × 10⁻¹⁶, confirming every bottleneck the formula named. On 500-user trees, Stage 1 took 12.1 ms against 93.1 ms for the LP. Stage 3 lowered the temporal variation only where multiple Stage-2 optima were detected. Of five allocation rules, only the hierarchy, equal proportional allocation, and full leximin always preserved the guarantee; of those three, the hierarchy delivered the most water in the median. In a controlled Gone Abat Jap scenario, ±10% demand perturbations moved the binding resource from source to reach in 61% of draws. The results verify a model-specific characterization, not field performance.

Fair water allocation is difficult when claimants share lossy canals and reserve supplies. CTI-RLex (claimant–terminal-invariant robust lexicographic allocation) is a linear-programming workflow that raises the weakest guaranteed monthly service lexicographically across enumerated shortage and outage scenarios, subject to reach capacities, conveyance losses, source limits and a bounded recourse budget. Fairness follows claimants, not delivery records. The guarantee vector is unique in exact arithmetic and holds on every convex combination of the scenarios within the combined budget. On a three-claimant Utah benchmark, the minimum guarantee rises from 0.1077 under utilization maximization to 0.4195 at a 2.57% nominal-delivery cost, and bounded recourse adds 9.22% over a rigid plan. Under gauge-scaled supplies, the plan kept every guarantee in all 33 seasons of 1993–2025. On a fifteen-claimant county instance in nine components, the sorted vectors first differ at position two, 0.0689 against 0.0564 under a common floor. One claimant rather than four stays at the floor, at 0.9% lower nominal delivery. Within decree-priority tiers, it gives the same guarantees unless reservoir storage ranks after every decreed right. Recorded 2025 diversions match the seasonal timing of the modeled demand, but two canals diverted two to three times that demand. Both instances remain uncalibrated benchmarks.

Gates move in finite steps and ignore changes below a deadband, so a gate opening from closed passes at least one quantum per step. For max–min delivery at a canal node through sealing gates that start the day closed, with exact levels and executed commands, it is proved that direct execution excludes users with plans below 1 − 1/(2k) of a quantum, k the deadband in resolution steps. Minimum deliveries cost the max–min level at most the summed quanta over total demand, and whole steps the summed step volumes over the demand of outlets still above quanta. A θ pulse rule serves every positive plan below the daily pulse capacity within −θ to +1 pulse, and carrying the debt forward bounds the cumulative error by one pulse. For ten recorded seasons at the Dustlik node, Kegeyli canal, Uzbekistan, the gates lowered the max–min level of a static constant-level allocation by under 0.001. In closed-loop Saint–Venant simulation with plan-derived demands, direct execution excluded the smallest regulator on exactly the 77 predicted early-April days of assumed demand, pulse rules served it, and carry-over cut its unweighted mean absolute dekadal error from 6.5% (pulse rule) to 1.0% of demand, shifting deliveries between days.