code: func queryByTag(c context.Context, pkg, tag string, cursor datastore.Cursor, pageSize int32) (
  	out []*datastore.Key,
  	next datastore.Cursor,
  	err error) {
  
  	// TODO(vadimsh): 'registered_ts' here is when the tag was attached. The
  	// callers likely expect results ordered by instance registration time. This
  	// is not possible currently. We'll need to copy Instance.registered_ts into
  	// InstanceTag entities, so we can order by instance registration time.
  
  	// TODO(vadimsh): Should we exclude unprocessed instances from the result?
  
  	q := datastore.NewQuery("InstanceTag").
  		Ancestor(PackageKey(c, pkg)).
  		Eq("tag", tag).
  		Order("-registered_ts").
  		Limit(pageSize).
  		KeysOnly(true)
  	if cursor != nil {
  		q = q.Start(cursor)
  	}
  
  	err = datastore.Run(c, q, func(k *datastore.Key, cb datastore.CursorCB) error {
  		out = append(out, k.Parent())
  		if len(out) >= int(pageSize) {
  			if next, err = cb(); err != nil {
  				return err
  			}
  			return datastore.Stop
  		}
  		return nil
  	})
  	if err != nil {
  		return nil, nil, errors.Annotate(err, "failed to query by tag %q", tag).Tag(transient.Tag).Err()
  	}
  	return
  }
docs: // queryByTag returns keys of Instances that have the given tag attached.
  //
  // Returns up to 'pageSize' of results, along with a cursor to continue the
  // query or nil if it was the end of it.