Cartridges connect to the "exp" port. You shouldn't specify -cart/-cartridge and -exp at the same time. You can that the -cart/-cartridge media option and -exp slot option are the same thing because you have this:
    <device type="cartridge" tag="exp" interface="c64_cart,vic10_cart">
        <instance name="cartridge" briefname="cart"/>
        <extension name="80"/>
        <extension name="a0"/>
        <extension name="e0"/>
        <extension name="crt"/>

The poorly-named "instance" tells you the command-line media options, and the "tag" attribute shows the media device's tag relative to the machine root.

Then you have this:
    <slot name="exp">
        <slotoption name="buscard" devname="c64_buscard"/>
        <slotoption name="turbo232" devname="c64_turbo232"/>
        <slotoption name="midisiel" devname="c64_midisiel"/>
        <slotoption name="swiftlink" devname="c64_swiftlink"/>
        <slotoption name="supercpu" devname="c64_supercpu"/>
        <slotoption name="speakez" devname="c64_speakeasy"/>
        <slotoption name="sfxse" devname="c64_sfxse"/>
        <slotoption name="neoram" devname="c64_neoram"/>
        <slotoption name="georam" devname="c64_georam"/>
        <slotoption name="cpm" devname="c64_cpm"/>
        <slotoption name="dqbb" devname="c64_dqbb"/>
        <slotoption name="reu1764" devname="c64_1764reu"/>
        <slotoption name="buscard2" devname="c64_buscard2"/>
        <slotoption name="16k" devname="c64_16kb"/>
        <slotoption name="ide64" devname="c64_ide64"/>
        <slotoption name="reu1700" devname="c64_1700reu"/>
        <slotoption name="midipp" devname="c64_midipp"/>
        <slotoption name="midisci" devname="c64_midisci"/>
        <slotoption name="reu1750" devname="c64_1750reu"/>
        <slotoption name="easyflash" devname="c64_easyflash"/>
        <slotoption name="midimap" devname="c64_midimap"/>
        <slotoption name="music64" devname="c64_music64"/>
        <slotoption name="midins" devname="c64_midins"/>

The "name" attribute is the tag relative to the machine root - it's the same as the tag for the media device, so you know it's the same thing.