For those who like longer answers… Surge and Thalin-"When an encounter card with the surge keyword is revealed during the staging step of the quest phase or in setup, reveal 1 additional card from the encounter deck. Resolve the surge keyword immediately after resolving any when revealed effects on the card."
So it goes when revealed on card-surge-any responses. but Thalin activates before "when revaled" so "When an enemy card is revealed from the encounter deck, Thalin’s ability resolves before any keyword or “When Revealed” card effects on the encounter card"
For the control question RAW says Players do not gain control of encounter cards unless control of the card is explicitly granted by a card effect. When an encounter card (such as Caught in a Web, CORE 86) becomes an attachment and attaches to a character, that character’s controller does not gain control of the attachment.(1.07) Control of Objective CardsWhen a player claims an objective card, he gains control of that card unless otherwise directed by a card effect. so unless the quest card uses the word claim it is not under control of the player. I would advise an errata to always claim objectives granted by quest cards. but for now…
and this Any card that attaches to another card is treated as an Attachment in addition to its other card types.The “Attach to…” rules text on an attachment is only a play restriction, and is not taken into account after the card is already attached. Which means several things "No Attachments" means no card can be attached, and abnormal ways cards get attached still have an effect. Nameless things can get trapped for example