How can I know *exactly* when my name_new domain is ready for the name_firstupdate step? The FAQ very vaguely says "Wait at least 12 blocks", but it doesn't make much sense to me.

Unless I have totally misunderstood how this works, once the name_newd domain is in the chain, I should safely be able to proceed to the next step... so how can I know exactly if it is ready? Or am I missing something?
It seems you can issue your name_firstupdate transaction whenever you're ready (in particular, right after doing the name_new).  It won't be included in a block until the name_new is mature (12 confirms) but should be picked up shortly after that happens.

I don't have any source for this other than recent experience, but my names are showing up when I do name_list so I take it that they are properly registered.

EDIT: I thought about it a little, and I suppose you should wait a little bit (at least until your name_new is included in a block).  The reason being that nobody can know what name you're trying to register until you do name_firstupdate, and so they can't steal it from you.  Sending both the name_new and the name_firstupdate is vulnerable because someone can quickly issue their own name_new for the same name, and depending on luck (or in the worst-case, their control of a significant hashrate) claim it before you can.

Someone more familiar with the intimate details of how requests for the same name are resolved can comment on whether this scenario is possible or not.