How does the search space work for finding a valid block?

Hey everyone, I'm diving into a project about solo mining Bitcoin and I'm stuck on a couple of points. 1) What are the exact degrees of freedom when it comes to finding a valid block? Like, what’s the actual search space? 2) What ensures that in this search space, a valid block will definitely be found? Here's a bit more context on my questions: I get that miners request a block template using the "getblocktemplate" RPC command. Using the "bits" field, they can figure out the target hash that a valid block's hash needs to be lower than. I know the network can create new block templates during mining as new transactions come in. So miners can keep their templates fresh by using the "longpool" feature. Plus, they have the ability to pick which transactions they want to include in their blocks, which means they can leave out some, as long as they're not mandatory. They can also set any arbitrary message string for the coinbase transaction and tweak the timestamp a bit. So for each of these choices, they loop through the "nonce" field from 0 up to 2^32-1. If they go through all the nonces for a fixed set of choices and still don’t meet the target hash, they can change their choices: switch up the coinbase message, include or exclude transactions, or adjust the timestamp. Is my understanding on point? Basically, are the degrees of freedom just those choices?