What Problem This Solves

#103341 fixed malformed Unicode token hints in the core logger, but the independently localized memory-host error formatter retained the same raw UTF-16 slicing pattern. A secret with an emoji crossing either retained edge could therefore still produce an unpaired surrogate in memory-host errors exposed through embedding batch helpers, SQLite/QMD diagnostics, or JSON result surfaces.

Why This Change Was Made

This completes the bug-class fix at the remaining owner. Both retained memory-host hint edges now use the existing sliceUtf16Safe helper. The memory-host format remains deliberately unchanged: six/four UTF-16-unit budgets, ... as its separator, full masking for short values, and no additional disclosed characters.

The regression exercises the exported memory-host engine entrypoint rather than only the private formatter. It covers both split edges, intact emoji pairs, ASCII parity, a JSON serialize/parse round trip, and absence of the original secret.

User Impact

Memory indexing and embedding error paths no longer introduce malformed Unicode while redacting long secrets. Existing ASCII hints and masking thresholds are unchanged.

Evidence

• Current-main source proof: packages/memory-host-sdk/src/host/error-utils.ts still used raw slice(0, 6) and slice(-4) after fix(logging): keep redacted token hints UTF-16 safe #103341 landed; either boundary can return a lone surrogate.
• Duplicate audit: no open PR touches the memory-host formatter, and exact searches found no competing fix.
• Fresh exact-head autoreview: clean, patch-correct confidence 0.91.
• git diff --check: passed.
• oxfmt --check on both touched files: passed.
• One-shot Testbox run 29107562708 verified exact head c436e835f1b32af9aa8cabc0183f8a2ec085e2db and tree 6dd00937f64dda6068efcaa524e5dc219342f440 before and after proof. The memory-host negative control failed only the leading/trailing split cases while intact emoji and ASCII cases passed; the pre-fix(logging): keep redacted token hints UTF-16 safe #103341 logger failed its matching regression.
• Fixed focused suites passed: memory-host 8/8 and logging 117/117.
• A live node --import tsx probe exercised the exported memory-host entrypoint and production logger through a JSON round trip; both strings were well-formed, the raw token was absent, and each surface retained its existing ... / … separator.
• check:changed passed for core and coreTests, including production/test typechecks, lint with zero findings, import-cycle analysis, and repository guards.
• Hosted CI is running on the same head and will be confirmed before merge.

Follow-up credit is preserved from #103341: co-authored with @zhangguiping-xydt.