A 400-site retail fabric runs full mesh-capable transports, but constant IPsec to every spoke wastes resources and 95% of store-to-store traffic is occasional inventory lookup. The engineer wants tunnels only when needed. Which on-demand tunnel behavior correctly triggers dynamic spoke-to-spoke data-plane tunnels?

The correct behavior is right because on-demand design keeps hub control connectivity steady while direct store-to-store IPsec plus BFD is created reactively by the first inventory packet and removed after idle timeout, fitting occasional traffic across mesh-capable transports without holding 400-site state continuously. The OMP-triggered proactive variant fails by trigger concept because OMP distributes routes for many destinations regardless of active flows, so building on route receipt recreates near full-mesh overhead to cut first-packet delay and defeats the only-when-needed saving, although proactive BFD is common for voice or critical sites. The no-BFD immediate-build variant fails by liveness concept because IPsec without BFD lacks peer-failure and path-quality detection across NAT and diverse underlays, so a dead direct path can blackhole lookups despite saving overhead, whereas BFD must validate the adjacency. The permanent-reuse variant fails by lifecycle concept because retaining every once-used tunnel lets idle state accumulate toward mesh scale and restores CPU, memory and tunnel-count pressure that idle timeout prevents, although persistence suits latency-sensitive reuse. Exam caveat is to separate OMP control-plane reachability from IPsec data-plane state, since routes may be present while on-demand tunnels correctly stay down until traffic arrives. Practical check is to send one store-to-store flow, verify the direct tunnel and BFD appear only then, then verify they age out after the idle period.