Salesforce AppExchange playbook

You take a SaaS product onto AppExchange, whose newer pages say AgentExchange: a reviewed partner, a package or API integration, a security gate, and a revenue share. The expensive mistakes happen before the listing exists.

Commitments you cannot undo

• Listing type (Packaged Solution, API, Consultant) is fixed at creation; moving from API to a package later means a new listing.
• Namespace is fixed to a 2GP package at creation and prefixes every component API name (acme__Invoice__c).
• Promotion to managed-released never reverses; only one beta per minor version can be promoted.
• Beta installs run only in scratch orgs and sandboxes and never upgrade. Pilot customers need a released version behind an installation key.
• Global Apex classes and global Visualforce components can never be removed. Most other released components can only be deprecated, after a Partner Support case enables removal. Mark internal-only custom settings, metadata types, labels and permissions protected: once released unprotected, they stay.
• OAuth controls on a Connected App or External Client App (ECA), once enabled, cannot be turned off. See references/security-review-prep.md before switching them on.