When an irrigation canal is put on restriction, what is fair depends on the water each user receives, not on what was allocated: transport delay and the stabilising low-pass filter re-shape every order on the way to the offtake. We pose the problem as lexicographic max-min optimisation of the fraction of each user’s order delivered inside an agreed window, after the filter. The orders are the decision variables, re-shaped before the filter, leaving the controller and filter untouched. The delivered fractions are affine in the orders, so this is a finite sequence of linear programmes. Relaxing the control law alone yields a certified upper bound; an infeasibility certificate reports whose order cannot be met and what must give. On a published eight-pool test canal the criterion raises the worst-off delivered fraction by 0.074 to 0.180 over leaving orders unchanged; the bound is attained at nine of eleven operable supply levels, where the control layer loses nothing. A 50% larger volume budget leaves the lexicographic answer unchanged. The filter’s order decides whether a feasible schedule exists, its cut-off only what is delivered; neither moves the comparison between criteria much. On this canal filter design precedes the choice of fairness criterion.

On lossy irrigation trees, the nominal max–min guarantee has a closed form for deterministic data. With random demands and source capacity, the joint chance-constrained guarantee is the largest service level all users and periods meet jointly with a prescribed probability. A recursion on a loss-rescaled lattice brackets the probability that all capacities suffice; the one-period bracket on the guarantee has a leading-order relative width at most twice the binding-probability-weighted relative lattice step. In one-factor models, certified integration brackets the guarantee with bounded rounding errors and, under stated conditions, converges; in a generalized factor model, the guarantee does not decrease as period-factor correlations increase. Under stated conditions, its capacity elasticities equal binding probabilities. In the Gone Abat Jap network (rule-based capacities, assumed source parameters), all brackets at probability 0.95 lie below the nominal guarantee 0.85. If dry years also lower the source, the guarantee lies in [0.52755, 0.53282], whose lower end is 6.5–6.7% above estimated safe individual-constraint designs; the naive design misses the target. The source, the nominal bottleneck, binds at the guarantee with estimated conditional probability 0.926 (0.040 if deterministic).