.
5. If a nonce is found, job_id, ntime, vmask, nonce2, nonce, and user_id are sent back to the pool. Then, the pool re-create block header data, and test it.
6. Then, the pool submit validated block header data with the pool's a bitcoin address to bitcoin core network.
I believe the pool's bitcoin address must be hashed into every share the miner submits, the pool won't add it later, the pool will simply relay the block as is. Correct me if I am wrong.