watchpr: start the conflict window at the arm

The window ran from the first non-mergeable poll even while the rule was
disarmed, so the poll that armed it confirmed a run it played no part in.
Measure from the later of the run's start and the arm; re-arming stays a
no-op so a base moving under every poll still confirms.

cmd/watchpr/main.go

@@ -5,11 +5,11 @@
 // agent's own pushes and comments) are ignored, and so is any condition that was
 // already true at the baseline -- which watchpr prints on stderr (as a JSON
 // record under --json), so a run started against a conflicted or CI-red PR says
-// so. One case is never reported at all: a conflict introduced by the push
-// immediately before the watch started, on a PR whose head and base then never
-// move, stays silent for the whole run, because nothing in Gitea's payload
-// separates it from a merge check still in flight. The baseline line is the
-// only notice of it.
+// so. A conflict introduced by the push immediately before the watch started is
+// not reported while the commits stay put, because nothing in Gitea's payload
+// separates it from a merge check still in flight; the baseline line is the only
+// notice of it. A later move of the head or base arms the rule without alerting,
+// and restarts the two-minute window from itself.
 //
 //	watchpr owner/repo#12 owner/repo:15
 //	watchpr --once --json owner/repo#12
@@ -73,7 +73,7 @@ func newRootCmd() *cobra.Command {
 				}
 				refs = append(refs, ref)
 			}
-			c := clientFor()
+			c := clientFor(jsonMode)
 			if once {
 				return runOnce(c, refs, jsonMode)
 			}
@@ -99,15 +99,33 @@ func newRootCmd() *cobra.Command {
 // clientFor builds the Gitea client. Watching public repos works anonymously,
 // so an unavailable token is a warning, not a failure; a poll that is actually
 // rejected re-mints then.
-func clientFor() *agent.GiteaClient {
+func clientFor(jsonMode bool) *agent.GiteaClient {
 	token, err := agent.GiteaToken()
 	if err != nil {
-		fmt.Fprintf(os.Stderr, "warning: no Gitea token (%v); polling anonymously\n", err)
+		warn(os.Stderr, jsonMode, "no Gitea token (%v); polling anonymously", err)
 		token = ""
 	}
 	return agent.NewGiteaClient(token)
 }
 
+// warnRecord is the --json form of a warning. Under --json stderr carries
+// nothing but NDJSON records, so a caller parsing it line by line never has to
+// guess which shape a line is.
+type warnRecord struct {
+	Warning string `json:"warning"`
+}
+
+// warn writes a non-fatal notice to stderr in whichever form the caller asked
+// for.
+func warn(w io.Writer, jsonMode bool, format string, args ...any) {
+	msg := fmt.Sprintf(format, args...)
+	if jsonMode {
+		_ = json.NewEncoder(w).Encode(warnRecord{Warning: msg})
+		return
+	}
+	_, _ = fmt.Fprintf(w, "warning: %s\n", msg)
+}
+
 // runOnce fetches and prints the current state of each PR, then exits 0.
 func runOnce(c *agent.GiteaClient, refs []agent.PRRef, jsonMode bool) error {
 	login := agent.AgentLogin()
@@ -140,7 +158,7 @@ func runWatch(c *agent.GiteaClient, refs []agent.PRRef, interval time.Duration,
 		emitBaselines(os.Stderr, states, interval, jsonMode)
 	}
 	onError := func(ref agent.PRRef, err error) {
-		fmt.Fprintf(os.Stderr, "warning: polling %s: %v\n", ref.String(), err)
+		warn(os.Stderr, jsonMode, "polling %s: %v", ref.String(), err)
 	}
 
 	res, err := agent.Watch(c, refs, login, ticker.C, onBaseline, onError)
@@ -233,8 +251,11 @@ func baselineLine(st agent.PRState) string {
 
 func suppressedAtBaseline(st agent.PRState) string {
 	var conds []string
-	if st.Mergeable == agent.MergeNo {
+	switch st.Mergeable {
+	case agent.MergeNo:
 		conds = append(conds, "already non-mergeable (a real conflict, or Gitea still recomputing)")
+	case agent.MergeUnknown:
+		conds = append(conds, "mergeability unknown (the conflict rule is disarmed until Gitea answers or the commits move)")
 	}
 	if st.CIStatus == "failure" || st.CIStatus == "error" {
 		conds = append(conds, "CI already "+st.CIStatus)