It surely doesn't matter how leading or contorted the prompt has to be if it shows that the model is encoding the copyrighted work verbatimly or nearly so.

It definitely does, which is why I put substantial amount of verbatim material. If someone can recite the first paragraph of Harry Potter and the sorcerers stone from memory, it surely doesn't mean they have memorized the entire book.

Of course not. But if the passage they can recite is long enough that it is copyrightable, then surely distributing a thing that (contortedly or not) can do said recitation is a form of redistribution of the work itself?

No. It is against their TOS to attempt to jailbreak their models. While I don't agree that the models can recite longer periods of verbatim copyrighted material, even if it could, the person who is at fault is the person subverting the system, not the creator of the system. If I steal a library book and make copies of it to distribute illegally, it wouldn't make sense to hold the library at fault for infringing on the book publisher's copyright.

This is an interesting take that I hadn't considered. Your analogy with a library break-in is good. I'll need to digest this. Thanks.