CCI page: split Assessment Procedure into labeled 800-53A / DoD AP lines

The Assessment Procedure column rendered the 800-53A reference inline and
hid the DoD AP acronym in a hover-only title tooltip (unreachable on touch,
and easy to miss on desktop). Surface both as stacked, labeled lines:

  800-53A: AC-1.1 (i and ii)
  DoD AP:  AC-1.3

- apCell now emits an "800-53A:" line for a true version-1 reference (or the
  control-ref fallback + "from Rev N" badge when there's no 800-53A ref), and
  a second "DoD AP:" line whenever the CCI carries a DoD assessment procedure
  (1,116 rows show both; 1,796 fallback rows still get the DoD AP line).
- Removed the now-redundant whole-cell DoD-AP title tooltip.
- Exports keep up: Excel ('export' orthogonal) emits clean labeled text, and
  sort/filter now also match the DoD AP value so the column is searchable by
  either identifier.
- Muted .ap-label styling keeps the identifiers themselves prominent.

No controller/JSON change (ap_acronym was already in the row data); CciControllerTest stays green (3 tests).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: CyberSecDef

cyber.trackr.live/templates/cci/index.html.twig

@@ -27,6 +27,11 @@
         padding: .5rem .625rem; border-radius: 6px;
         font-size: .8rem; line-height: 1.35; box-shadow: 0 4px 14px rgba(0,0,0,.28);
       }
+      /* Assessment Procedure cell: one labeled line per source — the 800-53A
+         reference and (when present) the DoD AP acronym, stacked. */
+      #ccis .ap-line { display: block; }
+      #ccis .ap-line + .ap-line { margin-top: .3rem; }
+      #ccis .ap-label { color: #8a8f98; font-size: .78rem; font-weight: 600; margin-right: .2rem; }
     </style>
     <section class="lib-page" aria-labelledby="cci-page-title">
         <div class="rule-text">&sect; Library &middot; CCIs</div>
@@ -102,18 +107,35 @@
             if (type !== 'display') return data || '';
             return (data && String(data).trim() !== '') ? esc(data) : na(NOTE_DOD);
         }
-        // Assessment Procedure: full 800-53A ref(s) when present, else the control-ref
-        // fallback (Rev 5 -> 4 -> 3) flagged with a "from Rev N" badge. The DoD AP acronym
-        // (when known) rides along as a tooltip for cross-reference.
+        // Assessment Procedure: a labeled line for the 800-53A reference(s) — or the
+        // control-ref fallback (Rev 5 -> 4 -> 3) flagged with a "from Rev N" badge — and,
+        // when the CCI carries a DoD assessment procedure, a second "DoD AP:" line below it.
         function apCell(data, type, row){
             const a = row.assessment || [];
-            if (type !== 'display') return a.join(', ');
-            if (!a.length) return na(NOTE_AP);
-            let h = a.map(pill).join(' ');
-            const label = { '5': 'from Rev 5', '4': 'from Rev 4', '3': 'from Rev 3' }[row.assessment_src];
-            if (label) h += ' ' + pill(label);
-            if (row.ap_acronym) h = '<span title="DoD AP acronym: ' + esc(row.ap_acronym) + '">' + h + '</span>';
-            return h;
+            // Excel export (orthogonal 'export'): clean labeled text, one item per line.
+            if (type === 'export') {
+                const parts = [];
+                if (a.length) parts.push((row.assessment_src === '1' ? '800-53A: ' : '') + a.join(', '));
+                if (row.ap_acronym) parts.push('DoD AP: ' + row.ap_acronym);
+                return parts.join('\n');
+            }
+            // Sort/filter/type: refs plus the DoD AP so the column stays searchable by both.
+            if (type !== 'display') return a.join(', ') + (row.ap_acronym ? ' ' + row.ap_acronym : '');
+            const lines = [];
+            if (a.length) {
+                const refs = a.map(pill).join(' ');
+                if (row.assessment_src === '1') {
+                    lines.push('<span class="ap-label">800-53A:</span>' + refs);
+                } else {
+                    const label = { '5': 'from Rev 5', '4': 'from Rev 4', '3': 'from Rev 3' }[row.assessment_src];
+                    lines.push(refs + (label ? ' ' + pill(label) : ''));
+                }
+            }
+            if (row.ap_acronym) {
+                lines.push('<span class="ap-label">DoD AP:</span>' + pill(row.ap_acronym));
+            }
+            if (!lines.length) return na(NOTE_AP);
+            return lines.map(l => '<span class="ap-line">' + l + '</span>').join('');
         }
 
         const cci_app = {