I've never used
ntpstat (it's not a standard install on debian/ubuntu) but have used ntp for many years and generally look at the output of
ntpq -nc peer or
ntpq -np which probably shows similar information. The
ntpq output does show positive and negative values.
Basically, if ntp(stat) says it's synchronized (or the output of ntpq flags a server with a '*') then it's as close as it can get but it will continue to try and improve.
A simplified explanation of the operation of NTP is that it regularly send packets to time servers containing a timestamp of the time the local machine thinks it is. The server then adds its timestamp and returns the packet to the local machine. As soon as it arrives, the local machine has a 3rd timestamp, the arrival time. Assuming the packet took the same time to reach the server and return, NTP can work out what the local machine's time was when the server added it's timestamp and hence can calculate a difference and make an adjustment.
Network packets generally take a few tens of milliseconds to reach the server and return. Due to network traffic variations, the outgoing and incoming transit times may not be the same, but there's no way to determine this, hence NTP has to assume they are the same. As a result, NTP can never get closer than a few milliseconds to exact synchronization and will declare synchronization when the send and receive timestamps bracket the server's timestamp.
Even when synchronized, NTP will continue to exchange packets and try to adjust the time to minimize the time differences. It does this by making small adjustments (actually by slightly increasing or decreasing the number of clock 'ticks' in a second) so that there are no sudden jumps and to avoid problems due to network anomalies.
ntpstat says it's synchronize, it's about as close as it can get, but it gives it's best estimate of how far off it's likely to be.