The only reason I suggested a fault tolerant system is due to your more-than-average concern of fire and major damage.I do not have statistic of BMS failure but I have not heard of BMS a lot. If 2 protections are demostrated to be enough, adding a third one or ten more is not going to offer any additional feature.
You need to be careful that your mechanization is not the actual cause of fire. Disabling charging sources at the bms can lead to component failure. I'm concerned of removing the battery connection to the charge controller before removing PV power. What about L di/dt spikes?
BTW, after some testing, I'm not a huge fan of the ADC1115. An external voltage reference is preferable. Actually, my son is also in the medical business. I'm a bit surprised the few hoops they need to jump through for approval.