Just a quick comment, or two, or three for now, I'm sure I'll "contribute" more as time goes on and glad nothing bad really happened because of this.
One, as shocked as you were, the "explosion" blew the guts out of one battery (just one right") and the gas discharged was more than the vents come take and the butt end came out. Sparks and burning lithium came out the end and did some damage. Scary, for sure, and on a larger scale than a standard battery doing the same thing, but less than could happen with a laptop battery while you sit and type.
An 85wh, 11.1 volt has 9 2600mah 18650 cells in a 3x3 series/parrallel configuration.
These are all UNPROTECTED CELLS. The protection is in the battery pack, but external to the cells themselves. Next time you shut your laptop down, take the battery pack and just hold it and look at the size of that sucka.
Physically the weak point in the flashlight mod is the butt end. And it should be. Yours did it's job, physically. The spewing sparks and bits of battery need to go somewhere, and the butt end is the direction I would prefer.
Electrically there is more to be determined.
Li-ion cells have had "construction quality" concerns in the past. Are cheap cells really cheaper, does spending more mean better quality?
What is really going on with "2-cell mods" might need a little more though and investigation. That statement that it might have been left on, and what is going on when a 2-cell mod starts to get a little low may be a lead to follow.
I think this may be an opportunity to improve the design of the detonator to not detonate (sorry, just couldn't resist). Individual cell monitoring for charge might be one additional complexity to consider adding. Cell balance while drawing current is the primary risk with unprotected cells in series. Active cell monitoring is one form of "protection". This means a contact at the midpoint and a modification to the "pack".
A positive means of controlling ON and OFF such as a timer circuit, or not having a continuous ON state at all. How many folks "forget" to turn the coffee pot off when they leave for vacation? Don't leave it to memory, make it go off on it's own.
I also caution folks to not put too much FAITH in protected cells. Protection circuits can go bad. Smart chargers can fail and get stupid. Don't put your charging station next to your EverClear. While many failure modes just stop operation, some can set up the same situation that happened to you.
Did the regulator survive? Can you determine if it is still operational? If you haven't tossed out all the parts, closely examine every millimeter for any component that survived, including soldered connection, wires, LEDs, switches. Start a Failure Analysis before doing anything to this valuable test unit.
Have a couple more cocktails, calm down, whew what an experience, and use this to your advantage. Sounds like an opportunity here.
Rocket
and a late comment to this post from the Swamp Lady (in nursing school).
Wound Care. You might want to consider chemicals introduced to the skin, blood stream during this event. Lots of water, Epsom Salt bath, salt water, just lots of water. Hot bath, a couple Scotch's, triple antibiotic. Clear the chemicals out, clear the mind out, clear the germs out, in that order.