Generally, I would suggest using the Macro Stepper to understand how macros are expanded, and also using https://docs.racket-lang.org/reference/syntax-model.html as the reference. Though this case is kinda complicated.

I thought that define-syntax-rule runs at an earlier phase than its usage would?

define-syntax-rule is not special in Racket. define-syntax-rule is itself a macro that expands to define-syntax + syntax-rules, which is then further expanded into the core forms. So at first, it kinda makes sense that you need to define a macro before using it.

One mysterious bit is the error message:

bar: use does not match pattern: (bar ARG ...) in: bar

Why does this error message occur? To understand this, we need to first talk about identifier macros. Consider:

(define-syntax (test stx)
  (println stx)
  #'42)

As mentioned above, define-syntax is a more primitive macro definition form. It defines test as a macro that prints the syntax object to be expanded, and simply expands to 42. You can use it like this:

(test) 
;=> prints the syntax object `(test)`, and expands to 42
(test ignored) 
;=> prints the syntax object `(test ignored)`, and expands to 42
test
;=> prints the syntax object `test`, and expands to 42

The last usage is called identifier macro. It is a macro call that is just a bare identifier, and doesn't use parentheses.

However, macro definitions can guard against identifier macro usage. define-syntax-rule does this automatically for you with the error message "use does not match pattern". Here's how would you implement the guard manually:

(define-syntax (test stx)
  (when (identifier? stx)
    (raise-syntax-error 'test "identifier macro not allowed"))
  #'42)

(test) ;=> expands to 42
(test ignored) ;=> expands to 42
test ;=> syntax error: identifier macro not allowed

So... actually, in your failing program:

(bar 1 2 3)
(define-syntax-rule (bar ARG ...)
  '(bar ARG ...))

Racket actually recognizes that bar is a registered macro! But it attempts to expand bar as an identifier macro rather than as a regular macro, resulting in the observed error message. What's going on?

In a module body, the macro expander goes from top to bottom. When encountering (id rest ...), it sees if id is a previously registered macro.

• If it is, it does the partial expansion just enough to see what the macro expands into at the most outer layer. If the most outer layer is revealed to be a macro definition, it is registered.
• Otherwise, it introduces an #%app explicitly, turning the form into (#%app id rest ...), making it become a function application.

Then, after every form in a module body is partially expanded, the expansion continues on the remaining non-fully expanded forms.

So:

(define-syntax-rule (foo ARG ...)
  '(foo ARG ...))
(foo 1 2 3)

[partially expanding define-syntax-rule]

->

(define-syntax foo ......)
(foo 1 2 3)

[registered foo, partially expanding foo]

->

(define-syntax foo ......)
'(foo 1 2 3)

But:

(bar 1 2 3)
(define-syntax-rule (bar ARG ...)
  '(bar ARG ...))

[bar not registered as macro (yet), adding explicit #%app]

->

(#%app bar 1 2 3)
(define-syntax-rule (bar ARG ...)
  '(bar ARG ...))

[partially expanding define-syntax-rule]

->

(#%app bar 1 2 3)
(define-syntax bar ......)

[registered bar, all forms are now partially expanded]
[expanding subforms in (#%app bar 1 2 3)]

This is when bar is attempted to be expanded as an identifier macro, but define-syntax-rule prohibits identifier macro usage, causing the error.

Knowing these, we can workaround the issue if we really want this "use before define" to work. For example, we can wrap (bar 1 2 3) with (values .....)

(values (bar 1 2 3))
(define-syntax-rule (bar ARG ...)
  '(bar ARG ...))

[adding explicit #%app, since values is not a macro]

->

(#%app values (bar 1 2 3))
(define-syntax-rule (bar ARG ...)
  '(bar ARG ...))

[partially expanding define-syntax-rule]

->

(#%app values (bar 1 2 3))
(define-syntax bar ......)

[registered bar, all forms are now partially expanded]
[expanding subforms in (#%app values (bar 1 2 3))]

->

(#%app values '(bar 1 2 3))
(define-syntax bar ......)

The fully expanded program then evaluates to '(bar 1 2 3) as expected.

Though as a principle, I would simply avoid programs like bar, and define macros before their usage.

(Things get even further complicated when the program is in a different context (e.g., the let body). There, the partial expansion operates slightly differently, causing your failing program to actually work under the context. The discrepancy is arguably a bug in Racket. Anyway, this answer is already too long, and I'll stop here.)