Nah dev should probably be a separate tld so the cookies are completely isolated.

Stage, it depends - if you want stage to have production data with newer code, and are fine with the session / cookies being shared - host it on the same domain and switch whether users get stage or prod based on IP, who is logged in, and/or a cookie. That way your code doesn't have to do anything different for stage vs prod every time it looks at the request domain (or wants to set cookies).

If you want an isolated stage environment, why not just use a separate top level domain? Otherwise you are likely seeing yourself up for the two interfering with each other via cookies on the TLD.

Yeah that's what I meant by separate domain - separate top level domain.

Not that we use cookies much but it's one less thing to worry about.