Users are able to set an Incident to Resolved without filling out the mandatory "Close Notes" field.
Expected behaviour if the incident is being set to Resolved using the list view. When using any one of the UI actions "Close Incident" or "Resolve Incident" from the form view, there is an onSubmit client script which executes and set the "Close Code" / "Close Notes" to Mandatory. The list update do not trigger this Client script and the fields won't be made Mandatory onSubmit :
As a workaround, you could either disable list edit or alternately create a data policy for this to set the close_notes and close_code to mandatory if the below condition is satisfied:
state is one of resolved, closed