restricted role still able to see listing of forum containers and categories

Can you post screenshots of your authenticated user role TAC configuration, as well as any other roles these users might have? Set issue to "active" once you have this info.

Also, are you using core forums? AF?

Edit: I just tested using approximately the configuration in your screenshots, and I was unable to reproduce this behavior using either core forums or advanced forums. In both cases the restricted container I created is properly hidden. Can you confirm the following:

1. The version of TAC you are using.
2. The versions of Drupal core and Advanced Forum you are using.
3. That the user screenshotted in the original post does not have the moderator role.

Some general troubleshooting to try:

1. Clear your site cache.
2. Rebuild permissions at admin/content/node-settings.
3. TAC troubleshooting: http://drupal.org/node/731850.

Alright, I tested again using exactly your forum vocabulary with the same versions of TAC, core, AF, and author pane and the same permissions configuration. I am still not getting the behavior in your screenshots. What I see instead is in the attached screenshots.

However, I can get the behavior in your screenshots if I grant the authenticated role list permissions for the moderator forum terms (with V/U/D still set to Deny).

So, the next thing I'd suggest is to double-check that the authenticated role has List unchecked for all the moderator forum terms. It is in your screenshot, but best to make sure.

If List is indeed unchecked, then that leads me to suspect another module is interfering with TAC's hook_db_rewrite_sql(). Troubleshooting to try (hopefully you have a non-production version of the site available):

1. Disable all contrib modules except for AF, TAC, and Author Pane.
2. Clear site cache and test to see if the bugged behavior still occurs.
3. If it does not occur, then one of your other contrib modules is causing the problem. The other taxonomy/forum/access control modules are good suspects. You can disable/enable individually to determine which one is the problem.
4. If the bugged behavior still occurs with only TAC, AF, and Author Pane enabled, then try disabling AF and Author Pane so that your site is using just the core forums.
5. Clear the site cache and test again.
6. If at this point the behavior does not occur, then my best bet is that something in your AF theme is causing the issue.
7. If the behavior still occurs with only TAC and core forums, I'm completely at a loss...

And you're quite certain no role other than the moderator role had List permissions for any of these forums or container terms? I'm completely baffled, because I can't duplicate this on my local test install using the same everything. The restricted forums disappear when I uncheck List for the authenticated user role for those terms, and reappear if I recheck it.

Last shots in the dark:

1. Have you tried disabling core's caching entirely?
2. What version of PHP are you running?
3. What database + version?
4. Are you using node revisioning?

How list permissions work

Since I can't reproduce the problem, I'll try to explain how the list permissions work so that you (or anyone else who has this problem) might be able to troubleshoot it and find out what's causing the bugged behavior.

The bit of TAC that should hide these forums from unauthenticated users is in the module's hook_db_rewrite_sql(). Any query that includes taxonomy terms gets a WHERE clause added that restricts the terms it can select to those for which the authenticated user has List permissions.

Authenticated user

See attached screenshots 1 and 2.

When I view the forum page as my test user (who has no role other than authenticated, and no list permissions for the moderator forum terms), these are the queries that I see in the devel query log:

SELECT t.tid AS tid, t.vid AS vid 
FROM term_data t 
INNER JOIN term_access_defaults tdg ON tdg.vid=0 
LEFT JOIN term_access_defaults td ON td.vid=t.vid AND td.rid=tdg.rid 
LEFT JOIN term_access ta ON ta.tid=t.tid AND ta.rid=tdg.rid 
WHERE tdg.rid IN (2) 
GROUP BY t.tid, t.vid 
HAVING BIT_OR(COALESCE( ta.grant_list, td.grant_list, tdg.grant_list )) > 0

This query selects a list of all the terms and vocabularies for which the authenticated role (tgd.rid IN (2)) has list permissions. The results of this query add a WHERE clause to the next query in taxonomy_get_tree():

SELECT t.tid, t.*, parent 
FROM term_data t 
INNER JOIN term_hierarchy h ON t.tid = h.tid 
WHERE (t.tid IN ('84')) AND ( t.vid = 6 )
ORDER BY weight, name

So, when the forum module requests a taxonomy tree for my forum vocabulary (t.vid = 6 in my case), it selects only the term for the member forums (t.tid IN ('84') for me) and so the other forums aren't rendered.

Moderator

See screenshots 3 and 4.

When I log in as my test moderator instead, these are the queries:

SELECT t.tid AS tid, t.vid AS vid 
FROM term_data t 
INNER JOIN term_access_defaults tdg ON tdg.vid=0 
LEFT JOIN term_access_defaults td ON td.vid=t.vid AND td.rid=tdg.rid 
LEFT JOIN term_access ta ON ta.tid=t.tid AND ta.rid=tdg.rid 
WHERE tdg.rid IN (2,7) 
GROUP BY t.tid, t.vid 
HAVING BIT_OR(COALESCE( ta.grant_list, td.grant_list, tdg.grant_list )) > 0

So it selects the allowed terms and vocabularies for roles 2 and 7, my moderator role (tdg.rid IN (2,7)), and as a result more terms are added to the where clause for the query in taxonomy_get_tree():

SELECT t.tid, t.*, parent 
FROM term_data t 
INNER JOIN term_hierarchy h ON t.tid = h.tid 
WHERE (t.tid IN ('84','88','89','90')) AND ( t.vid = 6 )
ORDER BY weight, name

So this time the terms for the member forum, moderator container, and two moderator subforums are all included in the where clause (t.tid IN ('84','88','89','90')), and the forums are rendered.

I know this is probably more than you ever wanted to know about TAC's internals, but since I don't see this bug I'm not sure what else to suggest.