RRG 2:
Resolve Damage: The attacker can resolve one of its
critical effects. Then the attacker determines the total
damage amount. Then the defending squadron or hull
zone suffers that total damage, one point at a time.
◊ If the attacker or defender is a squadron, the damage
is the sum of all F icons.
◊ If the attacker and defender are ships, the damage is
the sum of all F and E icons.
◊ Each ship has the following standard critical effect:
“E: If the defender is dealt at least one damage card
by this attack, deal the first damage card faceup.”
Just to be clear, I am not set on one position or the other. I don't think there is enough evidence either way in the rules to make a call one way or the other. It does appear that the intent is that they should stack, but for it to unequivocally function that way, either XX9 would need to be errata'd, or an FAQ would need to define the damage referenced on both XX9 and in the default crit effect to not include damage dealt by critical effects.
*inb4 Lyraeus' BUT DODONNA. We can argue about true randomness in card decks somewhere else, but I don't want to sidetrack this, and for the purpose of this discussion it doesn't matter.
I think this argues for the three face-up with both XX-9 and APT and Fire-control.
You may resolve a critical effect. So you "pop" the APT and deal a face-up damage card. Now Fire-control can trigger allowing you to "pop" the XX-9. If your damage vs. shields and token deals damage cards you'll deal up to two of them face-up.