Why does FIPS 180-4 require the final padding block start with a 1? From FIPS 180-4 § 5.1.1, the padding used for the SHA family of hashes begins with a binary 1, followed by a number of 0s, and finally a 64-bit representation of the message length:


Suppose that the length of the message, M, is  bits. Append the bit "1" to the
end of the message, followed by k zero bits, where k is the smallest, non-
negative solution to the equation  + 1 + k ≡ 448 mod 512. Then append the 64-bit
block that is equal to the number  expressed using a binary representation.


A form of this question has already been asked before, and the answer seems to be that it's likely because MD5 did that, and MD4 before that. But while that explains why MD5, SHA-1, and SHA-2 do it, it leaves the initial question unanswered. What is the purpose of starting the padding with a 1? If the correct answer for the SHS is "because that's how MD4 did it", then why did MD4 do it?

For SHA-3 which does not use length encoding, the purpose is to eliminate ambiguity:


  The initial 1 bit is required so messages differing only in a few additional 0 bits at the end do not produce the same hash.


MD4, which has always employed length encoding, still seems to use this padding.
If you don't start the padding with a $1$ it is not completely obvious where the padding starts.

If the message ends in

$...011010$

and you pad it to

$...01101000000$

which zeros were part of the message and which part of the padding?

If the padding is $1000...$ you know it started at the last $1$ in the padded string.

$...011010$

$...01101010000$

Edit:
Considering Why does the padding in Merkle–Damg&#229;rd hash functions like MD5 contain the message length?
This looks a bit like $10000...$ was used in the beginning and then the length was added for weaker assumptions on the compression function. In which case implementers probably complained that there are no real problems and that they didn't want to do any work, and that changes would require new certifications of products, etc. pp. and they ended up with this compromise which allows simply ignoring the last 64-bit block and using the old algorithms.