A manufacturing enterprise links four campuses in a metro area with latency-sensitive automation, requiring two-hour repair tolerance, balanced hop counts, and room to add two more sites without redesign. A single hub creates congestion and fate sharing. Which multi-campus interconnect topology optimizes resilience and scale?

The dual-hub partial mesh with diverse fiber is correct because two hubs remove single-point congestion and fate sharing while partial meshing keeps campus-to-campus paths to consistent low hops for deterministic automation latency, enables sub-two-hour restoration by switching hubs or paths, and leaves port and fiber capacity to add two sites without redesign. The dual-hub collapsed core with diverse uplinks is a standard enterprise design that aids repair and expansion, yet it fails the congestion requirement by funneling east-west automation through centralized cores where queuing and shared fate persist despite having two hubs. The protected SONET ring with rapid failover is a proven metro approach that preserves latency budgets and meets fast repair, yet it fails balanced hops because hop count and delay vary with position on the ring and with protection direction, harming deterministic automation. The full fiber mesh with direct links is common where latency and redundancy dominate, yet it fails growth without redesign because expanding from four to six campuses sharply increases links, fiber builds, optics, and management overhead. Exam caveat: do not choose rapid failover or direct-link latency alone; every stem constraint must be satisfied together. Practical check: confirm physically diverse conduits, measured hop latency and jitter, documented two-hour repair workflow, and free hub slots and strands for two future sites.