I get my information straight from the source code.

If you open util.c and find the function named json_rpc_call(), there's a parameter named rolltime. That is an outgoing parameter is set by a server-side value from the JSON RPC.
Now back to cgminer.c, where you can then follow "work->rolltime" around in the code and see how it's being compared to both the expiry setting and scan-time setting and in both cases, the server-side value is chosen over the local setting as long as it is largest.

This is all based on the source code, but I have of course also tested the settings with different values myself and I found no measurable differences.