A passive lossless network pays two different costs when it rotates a signal subspace over a frequency arc: a continuous Wigner—Smith action and an integer McMillan memory. Known Grassmannian length bounds and rational-inner degree identities constrain these resources separately. For the stated finite rational-inner class, we determine their joint attainable region exactly. Let two rank-k subspaces have principal angles βj, put B = Σj βj and let r be the number of nonzero angles. For a square finite rational inner transfer matrix of degree at most d, define the arc action A = ∫I tr Q(θ)dθ, where Q = −iS*∂θS is positive semidefinite. If B > 0, the exact feasible set is d ≥ r and 2B ≤ A ≤ 2πd − 2B. Both faces are attained. Equivalently, dmin(A) = max{r, ⌈(A + 2B)/(2π)⌉}. The upper face is a return cost: the complementary arc must rotate the subspace back, while the full-circle trace action is exactly 2π times the degree. We prove sufficiency by an explicit compiler of normalized rank-one Blaschke—Potapov gates; it realizes every interior point and both faces, including rank-deficient and orthogonal cases. When the endpoint subspaces coincide, the region changes discontinuously to A ∈ [0, 2πd), with the upper endpoint open. We derive fail-closed noisy degree certificates and give a multi-frequency warning using classical boundary Nevanlinna—Pick theory: three pairwise degree-one routing tasks can require degree two jointly. For orthogonal-line data the obstruction is a frame-independent cycle phase, exhibited by an exact positive semidefinite Pick completion with spectrum (2,1,0). Deterministic code compiles random points of the diamond, constructs the degree-two colligation, and is replayed by an independent verifier.