Doesn't deleting the manifest solve that? I thought serving a 404 for it makes browsers delete their cache exactly to provide a way out of this trap.

But yes, this is why I suggested testing with a separate subdomain.