It seems like you understand things just fine with one exception. When you are in
--dry-run mode rsync doesn't compute the checksums so you might see files that would not be transferred after the checksum is done.
Because the timestamp is different rsync knows that it will be updated, but since it is in dry-run mode it won't be able to report that the only thing that needs to be updated is the timestamp.
I'm using it to monitor failure of synchronization between remote machines... so it's really just a remote diff.
I don't know how to force a checksum in dry-run mode.
Since it sounds like you are trying to force a comparison of a local and remote set of synchronized files, then you might want to try something like this instead? (sha256deep can be replaced with sha1 or md5 deep if you want more speed).
diff -u <( /usr/bin/sha256deep -l -z -r -o f path | sort -k 3 ) \
<( ssh remote /usr/bin/sha256deep -l -z -r -o f path | sort -k 3 )`
That command would calculate the md5 checksum for each file both locally and remotely. The two lists are sorted on the path, and diff will show you and differences in the checksums.