RVK
Once again, you are the man!!
Yes, I moved the commit out to the end (basically the last thing to happen before the DBGrid is displayed), so it is only executed once per 1K files. And sure enough, it was faster than I could blink. In less than 1 second, the files were traversed, hashed and listed.
If I then revert it back to a commit per file, and it takes 38 seconds with hashing, or 36 without hashing (so if I just comment out the hash line and get it to write a random string).
So it seems there is the asnwer - SQLIte is fast, as long as you're careful with your commit frequency. As you say RVK, one per 1K queries is perhaps wise.