Only parameters being submitted to node/server is time, nonce and extranonce2.
I dont' think modifying merkel root is allowed. If mining software modifies merkel root, how server going to validate it against the parameters I'm submitting ?
The server can modify it, if it wants. I don't believe that ckpool does. I was just explaining how the mining space is infinite.