Cartridges connect to the "exp" port. You shouldn't specify -cart/-cartridge and -exp at the same time. You can that the -cart/-cartridge media option and -exp slot option are the same thing because you have this:
<device type="cartridge" tag="exp" interface="c64_cart,vic10_cart">
<instance name="cartridge" briefname="cart"/>
<extension name="80"/>
<extension name="a0"/>
<extension name="e0"/>
<extension name="crt"/>
</device>
The poorly-named "instance" tells you the command-line media options, and the "tag" attribute shows the media device's tag relative to the machine root.
Then you have this:
<slot name="exp">
<slotoption name="buscard" devname="c64_buscard"/>
<slotoption name="turbo232" devname="c64_turbo232"/>
<slotoption name="midisiel" devname="c64_midisiel"/>
<slotoption name="swiftlink" devname="c64_swiftlink"/>
<slotoption name="supercpu" devname="c64_supercpu"/>
<slotoption name="speakez" devname="c64_speakeasy"/>
<slotoption name="sfxse" devname="c64_sfxse"/>
<slotoption name="neoram" devname="c64_neoram"/>
<slotoption name="georam" devname="c64_georam"/>
<slotoption name="cpm" devname="c64_cpm"/>
<slotoption name="dqbb" devname="c64_dqbb"/>
<slotoption name="reu1764" devname="c64_1764reu"/>
<slotoption name="buscard2" devname="c64_buscard2"/>
<slotoption name="16k" devname="c64_16kb"/>
<slotoption name="ide64" devname="c64_ide64"/>
<slotoption name="reu1700" devname="c64_1700reu"/>
<slotoption name="midipp" devname="c64_midipp"/>
<slotoption name="midisci" devname="c64_midisci"/>
<slotoption name="reu1750" devname="c64_1750reu"/>
<slotoption name="easyflash" devname="c64_easyflash"/>
<slotoption name="midimap" devname="c64_midimap"/>
<slotoption name="music64" devname="c64_music64"/>
<slotoption name="midins" devname="c64_midins"/>
</slot>
The "name" attribute is the tag relative to the machine root - it's the same as the tag for the media device, so you know it's the same thing.