It is true that when an Escalation point is completed on Resolve and then Unresolved the Escalation Point will automatically open up again and count all the resolved time as being active and therefore the Incident might breach straight away.
This could be looked at as being wrong as some might want the Expire date to simply move forward with the same time as the Incident has been in the Resolve Status.
However according to ITIL this time is suppose to be counted as well, since the Incident wasn't Resolved as it needed to be Unresolved so this behaviour is correct and not a bug or a miss design.
However if you would like your Incidents to add on extra time for when they are being in the Resolved status should they be Unresolved again, you can do this with some easy Process changes.
1. You would need to add in an automatic "Stop clock" and "Start clock" action around your Resolve status. It should look like:
2. Set your Escalation point to Complete at the Closed Status and not the Resolve Status. Also make sure that the "If the Activation Status is reached more than once, re-use Escalations" tick box is ticked. It should look like:
This would make your Escalation go to STOP when being in the Resolved status and go to Complete on the Closed Status.
When ever an Escalation is being on STOP and then having the clock start again it will move the Expire date forward with the same amount of time as the clock was stopped.