Well, you're clearly thinking deeply about this and you seem to care. Which is great. I've been digging in deep on this the last few months so I have some thoughts. Respectfully (srsly), I think you might be misinterpreting the legislation (this resource is provides more concrete examples of how you should interpret it).

For example, Article 17(1) lays out the MANY grounds upon which a Data Subject can request erasure. If ONE of the mentioned criteria is met including the very broad Right to Object (Article 21) then it must be erased. 17(2) states you must fwd this request on to other online orgs. 17(3) provides the exceptions for which a Controller can object to the erasure.

It is important to note that the spirit of GDPR is one where Data Subjects rights (to their data, to object) are the default. Sort of like innocent until proven guilty. This is a big shift for most companies who would contend that they own the data & data exhaust from use of their application.

As for compliance demonstration... yes, this is still a mess. My only suggestion there is that if you're working with software companies, try to study what the leaders are doing and take some inspiration. https://www.enterpriseready.io/gdpr/preparing-for-gdpr/

Happy to hear your thoughts. Genuinely interested in other people's perspectives on this.