SPF works somewhat differently than you're trying to describe.
SPF records don't allow domains; they allow mail servers. When you put
a:domain.com in an SPF record, that only means "accept mail from the IP address found at
domain.com/A". If that actually points to your outgoing SMTP server, good. (In larger sites that wouldn't be the case.)
include:domain.com works in a similar way: instead of 'A' records, it does 'TXT' record lookups and imports domain.com's SPF policy. But that still boils down to "accept mail from those IP addresses that domain.com's SPF would have accepted".
So to answer the question,
include: won't include subdomains. That wouldn't make sense, and is actually impossible: there's no way for validators to know that a given IP address exists somewhere inside the domain.
SPF records themselves are found by looking up the sender's domain in DNS. For example, if the message has
firstname.lastname@example.org as its Envelope-From address, then SPF validators will search for a TXT record at
subdomain.example.com – but they will not search the parent domain.
In other words, SPF policy specified at
domain.com does not apply to messages sent by
*@subdomain.example.com. If you want both domains to be protected by SPF, you should either copy or 'include' the policy explicitly, or use the 'redirect=' modifier.