OK, seems all this was a misunderstanding of how Trident works. I allowed 2 supevisor slots on each machine, but kept 1 worker per machine. When I killed machine A, worker from machine A took the unused slot on machine B. First worker slot didn't restarted. I then restarted machine A and rebalanced the topology. Only one worker was moved. This is the behaviour I expected.
To put it in a nutshell : Always reserve empty slots for fault-tolerance. Thanks again for the time you took Anuj :)
