trying the latest refracta (i386-20161014_1432) with mkfigos, its working ok. no .service files, no machine-id, evince since machine-id is required for atril to load a pdf.
however, this is about refracta-- previous versions had the vt logged out (i thought the change would be in inittab, but both the old and new versions match: md5sum 5a107e6c5de94c95d3f2802e377670d5).
previously if you logged in and out of the vt, youd be logged out again.
now, each vt (1-6) is autologged in (thats new) and if you log out, it just re-logins and youre still logged in.
in other words, theres no longer a trivial way (like ctrl-d or exit) to log out of the vt. apt-get install vlock will let you lock them, though you have to run it on each vt (1-6, although vlock -a does the current vt and prevents switching to another.) for me this is suitable, but alternative methods are welcome. this pertains to refracta running live, havent tried installing yet.