Why don't I see 5F24 (Application Expiration Date) in the reader's response during EMV transaction?

There are several points for tag 5F24:

1. reader should do read record, 
2. to do read record, tag 94 (Application File Locator (AFL)) should appear in GPO (get processing response) response, 

About Test Case 1, the response of GPO of Above_Floor_Limit is without tag 94, so response of reader is without tag 5F24; the response of GPO of Below_Floor_Limit is with tag 94, so response of reader is with tag 5F24.

When transaction is online(0x23) or offline(0x00)?

In general, transaction go online when  transaction amount is above Floor Limit( tag 9F1B), so an online transaction when transaction amount is above $60(default).

But why transaction go online with transaction amount is above $10?  

Because the card type is ARQC. It could be determine by tag 9F27 (Cryptogram Information Data) or 9F10 (Issuer Application Data). In the Test Case 01, the value of tag 9F10 is 06 01 11 03 A0 20 00, and value of TTQ is A0 00 40 00, 

When card type is ARQC, reader would check Byte 1 bit 4 of TTQ.

There are 2 test case in Test Case 01, Above_Floor_Limit and Below_Floor_Limit. Card Type are ARQC and TC respectively. When card type is TC, reader would check Online cryptogram first, so "Online cryptogram not required" in TC case, and go offline.