The answer is simple: do not "dry-run", do "why-run"!
chef-client --why-run chef-client -WAnd the output looks nicer when using "-Fmin"
chef-client -Fmin -WAs with all other automation tools, the dry-run mode is not very predictive. Still it might indicate some of the things that will happen. See also