ShowProgess needs an explicit Simulator::Stop time
ShowProgress schedules itself.
If no explicit Stop time is set, by calling Simulator::Stop, the simulation will run until ShowProgress overflows the event timestamp. Since this is unsigned it wraps to negative values, triggering the negative delay assert in SimulatorImpl.
Simple solution: document that an explicit stop time is required. This is what is done for similar models, with, e.g, periodic Hello messages.
Hack solution: check if only the ShowProgress event is left, and stop then. This is a hack since it doesn't support other functions (Hello, for example) which shouldn't on their own continue the simulator.
Nicer solution: mark events which should not prolong the simulation, then somehow don't include those in deciding if there are any more "real" events. Not clear how to do this. Perhaps leverage ShowProgress itself to run through the event list and check for real events?