How does a SQL Server Availability Group with multiple synchronous-commit secondary replicas decide on which secondary replica will become the new primary when an automatic failover is triggered? Can't find any information on this in the documentation.
When using SQL 2012 AlwaysOn clusters (what you linked to) It appears that this functionality is controlled by Windows Failover Clustering. In WSFC, Each application can be given a server activation preference list, like so:
Note that the activation preference is only one factor in the failover decision. For instance, a server with a failed SQL service will not become the active node in a failover scenario, even if it is next in the preference order.