Help: Logout isn't working properly across subdomains.

Alright. Seen this one before. Everyone's "seamless SSO" falls apart at logout.

My setup:
* Primary domain: `app.company.com`
* Auth0 tenant domain: `company.auth0.com`
* Using Auth0 SPA SDK
* Logout call is `auth0.logout()`
* Expected: Session cleared on `app.company.com` and `admin.company.com`.
* Reality: Logs out of the initiating subdomain only. Others remain logged in.

Tried the obvious:
* Added `returnTo` parameter.
* Added `federated` option.
* Configured `Allowed Logout URLs` in dashboard.

Suspect this is a cookie domain issue. Auth0's session cookie isn't scoped to `.company.com`, so it can't be cleared across subdomains.

What's the actual, working config? Not the docs, the real steps.