diff --git a/src/commons/addr/ip.py b/src/commons/addr/ip.py
index 2aabe08..a95488e 100644
--- a/src/commons/addr/ip.py
+++ b/src/commons/addr/ip.py
@@ -115,7 +115,7 @@ def hosts(cidr: str, *, limit: Optional[int] = None) -> List[str]:
     gen = ipaddress.ip_network(cidr, strict=False).hosts()
     out: List[str] = []
     for host in gen:
-        out.append(str(host))
         if limit is not None and len(out) >= limit:
             break
+        out.append(str(host))
     return out
diff --git a/src/commons/masking.py b/src/commons/masking.py
index b06ab68..3d8b292 100644
--- a/src/commons/masking.py
+++ b/src/commons/masking.py
@@ -119,11 +119,14 @@ def stable_id(*parts: str, length: int = 16) -> str:
     """deterministic id from ordered parts; same inputs always produce the same id
 
     joins the parts with a ``\\x00`` separator (so ``("ab","c")`` != ``("a","bc")``) and
-    returns the leading ``length`` hex chars of their sha256. raises ValueError on an empty
-    part, a non-str part, or a non-positive length - fail loud rather than emit a weak id.
+    returns the leading ``length`` hex chars of their sha256. raises ValueError on no parts,
+    an empty part, a non-str part, or a non-positive length - fail loud rather than emit a
+    weak or constant id.
     """
     if length <= 0:
         raise ValueError(f"stable_id: length must be positive, got {length}")
+    if not parts:
+        raise ValueError("stable_id: needs at least one part")
     for part in parts:
         if not isinstance(part, str):
             raise ValueError(f"stable_id: parts must be str, got {type(part).__name__}")