Thanks again qwerty
for a very elaborate answer

.
Although a little disencouraging :-/
It's my impression that you have got quite some experience with this topic.
Well it looks like, IF we go ahead with it, we need to perform quite some tests/experimenting on the chosen solution.
1- Get All Packages: 'will come in the way' - I suppose that means: too heavy. I hope that any VC will recognize if a package (XMI) has not been changed since the client's existing package (?) in that way we
MIGHT be able to control it.
2- moving packages - yes, that worries me. I think, especially on this one, we'll need to do some experimenting on different scenarios.
Sequence diagram - interesting, who would have thought that!.
Benefits:
- Undo: But (assuming private models) I could export an XMI with the messed up private model, then undo, then compare with my XMI (possibly creating an extra, local repository from that XMI), fix everything

- and then check-in. In that way, other users would remain unaffected by the incident.
- audit: that
COULD though, in many cases make me aware of somebody's deletion perhaps months earlier than otherwise.
- backup: yes/no for us. The more concurrent users/projects, the worse a restore will be. (even with a continuous backup - although less so)
But of course, we will have to assess whether the VC will give more work than benefit! - and I guess, none of the challenges you mention depend on which VC we choose.
Again, thank you very much for your answers - they certainly have made me more concerned
