The answer is simple: do not "dry-run", do "why-run"! 
chef-client --why-run
chef-client -W
And the output looks nicer when using "-Fmin" 
chef-client -Fmin -W
As with all other automation tools, the dry-run mode is not very predictive. Still it might indicate some of the things that will happen. See also