When Category.merge finds no name match for a source child, it adopts that child by reference (categories.add(subCategory)). Later merges that name-match into the adopted child then mutate the original source's recipes and categories. Most upstream usage hides this — RecipeMarketplace.install(BundleReader) uses a throwaway source — but consumers that cache and reuse a RecipeMarketplace as a merge source see concurrent ConcurrentModificationException / ArrayIndexOutOfBoundsException from the shared ArrayLists, and silent state drift across sequential merges.

This PR allocates a fresh Category on the receiver and recurses to copy contents instead. The recipes loop was already safe — recipe.withMarketplace(this) returns a new instance.

RecipeMarketplaceMergeTest adds two tests pinning the invariant; both fail on parent, pass with the fix. The existing merge tests in RecipeMarketplaceReaderTest only exercise the name-match path and pass unchanged.