I've been giving this some more thought and am having trouble rationalizing picking the max value of broker's and app's heartbeat timeout during negotiation.
It seems that the value configured on the broker should serve as the default value for any connection, where the AMQP app doesn't provide an explicit heartbeat timeout value.
However, if the AMQP app provides an explicit heartbeat timeout value, it seems that the AMQP app knows the properties of its application best, and the values provided by the app should be respected verbatim (not the max).
For example, if the AMQP app has certain norms about how long processing of requests in the app should take (during which time communication may be blocked), it might set the heartbeat timeout at a value that would cause the connection to be dropped if the processing takes an unreasonably long to complete, based on the app's own understanding of "unreasonably long".