[core] Support set_internal() during setup, reject calls after setup

esphome/core/entity_base.cpp

@@ -56,6 +56,14 @@ void EntityBase::configure_entity_(const char *name, uint32_t object_id_hash, ui
   this->flags_.entity_category = (entity_fields >> ENTITY_FIELD_ENTITY_CATEGORY_SHIFT) & 0x3;
 }
 
+void EntityBase::set_internal(bool internal) {
+  if (App.is_setup_complete()) {
+    ESP_LOGE(TAG, "'%s': set_internal() called after setup, ignored", this->get_name().c_str());
+    return;
+  }
+  this->flags_.internal = internal;
+}
+
 // Weak default lookup functions — overridden by generated code in main.cpp
 __attribute__((weak)) const char *entity_device_class_lookup(uint8_t) { return ""; }
 __attribute__((weak)) const char *entity_uom_lookup(uint8_t) { return ""; }

esphome/core/entity_base.h

@@ -88,13 +88,10 @@ class EntityBase {
   // Get whether this Entity should be hidden outside ESPHome
   bool is_internal() const { return this->flags_.internal; }
 
-  // Deprecated: Calling set_internal() at runtime is undefined behavior. Components and clients
-  // are NOT notified of the change, the flag may have already been read during setup, and there
-  // is NO guarantee any consumer will observe the new value. Use the 'internal:' YAML key instead.
-  ESPDEPRECATED("set_internal() is undefined behavior at runtime — components and Home Assistant are NOT "
-                "notified. Use the 'internal:' YAML key instead. Will be removed in 2027.3.0.",
-                "2026.3.0")
-  void set_internal(bool internal) { this->flags_.internal = internal; }
+  // Set whether this Entity should be hidden outside ESPHome. Must be called before MQTT and the
+  // API read the flag: from on_boot at the default priority, or a setup() that runs above
+  // setup_priority::AFTER_CONNECTION. Calls after setup finishes are ignored and log an error.
+  void set_internal(bool internal);
 
   // Check if this object is declared to be disabled by default.
   // That means that when the device gets added to Home Assistant (or other clients) it should

tests/integration/fixtures/set_internal_at_boot.yaml

@@ -0,0 +1,34 @@
+esphome:
+  name: set-internal-at-boot
+  on_boot:
+    then:
+      - lambda: |-
+          id(hidden_at_boot).set_internal(true);
+          id(shown_at_boot).set_internal(false);
+
+host:
+
+api:
+  actions:
+    - action: set_internal_late
+      then:
+        - lambda: id(untouched).set_internal(true);
+
+logger:
+
+sensor:
+  - platform: template
+    name: "Hidden At Boot"
+    id: hidden_at_boot
+    lambda: return 1.0;
+
+  - platform: template
+    name: "Shown At Boot"
+    id: shown_at_boot
+    internal: true
+    lambda: return 2.0;
+
+  - platform: template
+    name: "Untouched"
+    id: untouched
+    lambda: return 3.0;

tests/integration/test_set_internal_at_boot.py

@@ -0,0 +1,38 @@
+"""Integration test for set_internal() called during and after setup."""
+
+from __future__ import annotations
+
+import pytest
+
+from .log_utils import LineWaiter
+from .types import APIClientConnectedFactory, RunCompiledFunction
+
+
+@pytest.mark.asyncio
+async def test_set_internal_at_boot(
+    yaml_config: str,
+    run_compiled: RunCompiledFunction,
+    api_client_connected: APIClientConnectedFactory,
+) -> None:
+    """set_internal() in on_boot changes API exposure, later calls are rejected."""
+    waiter = LineWaiter()
+
+    async with (
+        run_compiled(yaml_config, line_callback=waiter.callback),
+        api_client_connected() as client,
+    ):
+        entities, services = await client.list_entities_services()
+        names = {entity.name for entity in entities}
+
+        assert "Hidden At Boot" not in names
+        assert "Shown At Boot" in names
+        assert "Untouched" in names
+
+        late = next(s for s in services if s.name == "set_internal_late")
+        await client.execute_service(late, {})
+        await waiter.wait_for(
+            "'Untouched'", "set_internal() called after setup", timeout=5.0
+        )
+
+        entities, _ = await client.list_entities_services()
+        assert "Untouched" in {entity.name for entity in entities}