Most stateful code in production was never modeled at all. polygraph doesn't ask you to write a spec first — it generates independent specifications from the code itself, replays real traces against them, and model-checks whichever specification survives contact with reality.
You don't need a spec to start. polygraph builds and tests candidates for you.
Multiple candidate models of what the code does, derived from the code, not from what the comments or the original author claimed.
Actual execution history is run against every candidate spec; the ones that don't match reality are discarded.
The specification that matches reality is then checked exhaustively, surfacing the reachable states nobody exercised in production yet.